CVE-2026-34070

I Found a Path Traversal Bug in LangChain That Could Leak Your Cloud Credentials How a forgotten legacy API in one of AI's most popular frameworks quietly exposed millions of applications to arbitrary file reads. There's a certain feeling you get when a proof-of-concept works on the first try. No...

langgrinch-cve-2025-68664-analysis

LangGrinch Vulnerability Analysis: CVE-2025-68664 Overview This repository contains a technical report analyzing CVE-2025-68664, also known as LangGrinch, a serialization injection vulnerability affecting LangChain Core. The report explains the vulnerability background, root cause, exploitation...

CVE-2025-68664

CVE-2025-68664 All I Want for Christmas Is Your Secrets: LangGrinch Strikes LangChain Core CVE-2025-68664 Author: Yarden Porat Cyata Research: LangGrinch Vulnerability in LangChain Published: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Yesterday LangChain published a critical...

LangChain-Core < 0.3.81 / 1.x < 1.2.5

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...

ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root

Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in langchain-core - Patched by Root

Root has patched CVE-2026-34070 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in langchain-core - Patched by Root

Root has patched CVE-2025-68664 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in langchain-core - Patched by Root

Root has patched CVE-2026-44843 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1781571263 TuxCare security update for langchain-core (1 CVE)

TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post2+tuxcare...

CLSA-2026-1776126826 TuxCare security update for langchain-core (1 CVE)

TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post1+tuxcare...

PT-2026-74435

TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post1+tuxcare...

PT-2026-75062

TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post2+tuxcare...

accessiqlue (2025.12.21154255), agent-nexus-cli (>=0.1.0, <=0.1.31) +345 more potentially affected by CVE-2026-44843 via langchain-core (>=1.0.0, <=1.3.2)

langchain-core PYPI version =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2 - ai-mysql-translator 2025.12.21101721 - ai-reliability-analyzer 2025.12.21171415 - ai-risk-extractor 2025.12.21102659 - ai-seo-strategist 2025.12.21130456 - ai-workflow-automator 2025.12.21192054 - animtoreal...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1128 more potentially affected by CVE-2026-44843 via langchain-core (>=0.0.1, <=0.3.84)

langchain-core PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =3.2.0, =2.1.7, =0.0.2, =0.0.5 - agentc-langchain 1.0.0 and more Source cves: CVE-2026-44843 Source advisory: OSV:PYSEC-2026-2564...

accessiqlue (2025.12.21154255), agent-builder (>=0.0.2, <=0.1.7) +338 more potentially affected by CVE-2026-40087 via langchain-core (>=1.0.0a8, <=1.2.24)

langchain-core PYPI version =1.0.0a8, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.1 - ai-benchmark-analyzer 2025.12.21193050 - ai-claim-essence 2025.12.20202921 - ai-design-insights 2025.12.21145447 - ai-mysql-translator 2025.12.21101721 - ai-reliability-analyzer 2025.12.21171415 - ai-risk-extractor...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1123 more potentially affected by CVE-2026-40087 via langchain-core (>=0.0.1, <=0.3.83)

langchain-core PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =3.2.0, =2.1.7, =0.0.2, =0.0.5 - agentc-langchain 1.0.0 and more Source cves: CVE-2026-40087 Source advisory: OSV:PYSEC-2026-2563...

academic-metrics (>=0.1.0b0, <=1.0.99), chaincomposer (>=0.1.2, <=0.1.8) +2 more potentially affected by CVE-2026-26013 via langchain-core (0.3.19)

langchain-core PYPI version 0.3.19 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - academic-metrics =0.1.0b0, =0.1.2, =0.1.0, =0.2.0 - ia-planner-jerson-gpt 0.1.0 Source cves: CVE-2026-26013 Source advisory:...

safa (>=0.0.1, <=0.1.0), srai-langchain (0.1.0) potentially affected by CVE-2026-26013 via langchain-core (0.2.11)

langchain-core PYPI version 0.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - safa =0.0.1, =0.1.0 - srai-langchain 0.1.0 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

itext2kg (>=0.0.4, <=0.0.7) potentially affected by CVE-2026-26013 via langchain-core (0.3.0)

langchain-core PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - itext2kg =0.0.4, =0.0.7 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

langchain-anthropic (>=0.2.0.dev0, <=0.2.0.dev1), langchain-aws (0.2.0.dev1) +12 more potentially affected by CVE-2026-26013 via langchain-core (0.4.0.dev0)

langchain-core PYPI version 0.4.0.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-anthropic =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.3.0.dev0, =0.1.0.dev0, =0.1.0.dev1 Source cves:...