CVE-2026-34070

LangChain에서 발견한 경로 탐색 버그 — 클라우드 자격 증명이 유출될 수 있습니다 AI의 가장 인기 있는 프레임워크 중 하나에서 잊혀진 레거시 API가 어떻게 수백만 개의 애플리케이션을 임의 파일 읽기에 조용히 노출시켰는지. 개념 증명PoC이 첫 시도에 성공했을 때 느껴지는 특정한 감정이 있습니다. 정확히 말하면 흥분이라기보다는 — 실제로 무언가 일어났다는 느린, 불편한 깨달음에 가깝습니다. loadpromptfromconfig에 테스트 구성을 실행하고 읽어서는 안 되는 파일의 내용이 터미널에 그대로 출력되는 것을 보았...

CVE-2025-68664

CVE-2025-68664 Всё, что я хочу на Рождество, это ваши секреты: LangGrinch поражает ядро LangChain CVE-2025-68664 Автор: Ярден Порат Исследование Cyata: Уязвимость LangGrinch в LangChain Опубликовано: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Вчера LangChain опубликовал...

LangChain-Core < 0.3.81 / 1.x < 1.2.5

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...

langgrinch-cve-2025-68664-analysis

Анализ уязвимости LangGrinch: CVE-2025-68664 Обзор Этот репозиторий содержит технический отчет, анализирующий CVE-2025-68664, также известную как LangGrinch, уязвимость внедрения сериализации, затрагивающую LangChain Core. Отчет объясняет предысторию уязвимости, корневую причину, процесс...

ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in langchain-core - Patched by Root

Root has patched CVE-2026-34070 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in langchain-core - Patched by Root

Root has patched CVE-2026-44843 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root

Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in langchain-core - Patched by Root

Root has patched CVE-2025-68664 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

PYSEC-2026-1070 Malicious code in langchain-core-mcp (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of langchain-core-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...

PYSEC-2026-1517 langchain-core allows unauthorized users to read arbitrary files from the host file system

A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses pdfminersix-20251107-py3-none-any.whl, requests-2.32.5-py3-none-any.whl, langchaincore-0.3.81-py3-none-any.whl, pythondotenv-1.0.1-py3-none-any.whl, langchaintextsplitters-0.3.11-py3-none-any.whl, qs-6.15.1.tgz, idna-3.10-py3-none-any.whl, idna-3.14-py3-none-any.whl...

Malicious code in langchain-core-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd42d83950d8d8fc559905eed104af38cd6c8aef683b96778f0b8d778dd6bd5a Package langchain-core-mcp impersonates the legitimate langchain-core publisher: METADATA sets Project-URL Repository to...

GHSA-PJWX-R37V-7724 vulnerabilities

Vulnerabilities for packages: py3-langchain-core, py3-langchain...

CVE-2026-44843 vulnerabilities

Vulnerabilities for packages: py3-langchain-core, py3-langchain...

CVE-2026-44843 vulnerabilities

Vulnerabilities for packages: py3-langchain-core, py3-langchain...

GHSA-PJWX-R37V-7724 vulnerabilities

Vulnerabilities for packages: py3-langchain-core, py3-langchain...

LangChain Core 1.3.2 / 0.3.84 Tracer Deserialization / Credential Disclosure

LangChain Core has a tracer deserialization vulnerability that could allow unauthenticated remote credential exfiltration in affected deployments. Versions 1.3.2 and 0.3.84 are affected...

Deserialization of Untrusted Data

Overview langchain-core is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the load process. An attacker can instantiate trusted classes with untrusted constructor arguments by submitting specially...

📄 LangChain Core Insecure Deserialization

LangChain Core versions prior to 1.2.5 and 0.3.81 suffer from a deserialization vulnerability that allows for server-side template injection that can lead to remote code execution. Exploit Title: LangChain Core - SSTI/RCE Date: 2025-12-29 Exploit Author: Mohammed Idrees Banyamer Author Country:...

LangChain Core 1.2.4 - SSTI/RCE

Exploit Title: LangChain Core - SSTI/RCE Date: 2025-12-29 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Contact: @banyamersecurity Instagram GitHub: https://github.com/mbanyamer Vendor Homepage: https://www.langchain.com/ Software Link: https://pypi.org/project/langchain-core/...