64 matches found
langgrinch-cve-2025-68664-analysis
Análisis de Vulnerabilidad LangGrinch: CVE-2025-68664 Resumen Este repositorio contiene un informe técnico que analiza CVE-2025-68664, también conocido como LangGrinch, una vulnerabilidad de inyección de serialización que afecta a LangChain Core. El informe explica los antecedentes de la...
CVE-2026-34070
Encontré un Bug de Path Traversal en LangChain Que Podría Filtrar Tus Credenciales en la Nube Cómo una API heredada olvidada en uno de los frameworks de IA más populares expuso silenciosamente millones de aplicaciones a lecturas arbitrarias de archivos. Hay una sensación particular que sientes...
CVE-2025-68664
CVE-2025-68664 这一切我想在圣诞节得到的就是你们的秘密：LangGrinch 袭击了 LangChain 核心 CVE-2025-68664 作者：亚尔登·波拉特 Cyata 研究：LangChain 中的 LangGrinch 漏洞 已发布：https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ 昨天，LangChain 发布了一个关于我在 langchain-core 中发现的漏洞的关键警告：CVE-2025-68664 / GHSA-c67j-w6g6-q2cm。...
LangChain-Core < 0.3.81 / 1.x < 1.2.5
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...
ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in langchain-core - Patched by Root
Root has patched CVE-2026-44843 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in langchain-core - Patched by Root
Root has patched CVE-2026-34070 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root
Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in langchain-core - Patched by Root
Root has patched CVE-2025-68664 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
CLSA-2026-1781571263 TuxCare security update for langchain-core (1 CVE)
TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post2+tuxcare...
CLSA-2026-1776126826 TuxCare security update for langchain-core (1 CVE)
TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post1+tuxcare...
PYSEC-2026-1070 Malicious code in langchain-core-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of langchain-core-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...
PYSEC-2026-1517 langchain-core allows unauthorized users to read arbitrary files from the host file system
A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...
langchain-core allows unauthorized users to read arbitrary files from the host file system
A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...
Security Bulletin: Maximo AI Service uses langchain_core-0.3.81-py3-none-any.whl which is vulnerable to CVE-2026-26013.
Summary Maximo AI Service uses langchaincore-0.3.81-py3-none-any.whl which is vulnerable to CVE-2026-26013. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-26013 DESCRIPTION: LangChain is a framework for building agents and...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses pdfminersix-20251107-py3-none-any.whl, requests-2.32.5-py3-none-any.whl, langchaincore-0.3.81-py3-none-any.whl, pythondotenv-1.0.1-py3-none-any.whl, langchaintextsplitters-0.3.11-py3-none-any.whl, qs-6.15.1.tgz, idna-3.10-py3-none-any.whl, idna-3.14-py3-none-any.whl...
Malicious code in langchain-core-mcp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd42d83950d8d8fc559905eed104af38cd6c8aef683b96778f0b8d778dd6bd5a Package langchain-core-mcp impersonates the legitimate langchain-core publisher: METADATA sets Project-URL Repository to...
GHSA-PJWX-R37V-7724 vulnerabilities
Vulnerabilities for packages: py3-langchain-core, py3-langchain...
CVE-2026-44843 vulnerabilities
Vulnerabilities for packages: py3-langchain-core, py3-langchain...
