langcorn (>=0.0.1, <=0.0.4), langflow (>=0.0.52, <=0.0.58) potentially affected by CVE-2026-55443 via langchain (0.0.131)

langchain PYPI version 0.0.131 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langcorn =0.0.1, =0.0.52, =0.0.58 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

GHSA-GR75-JV2W-4656 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...

ai-rich (>=0.1.3, <=0.1.5), ananxw-jumpin (0.7.0) +11 more potentially affected by CVE-2026-55443 via langchain (0.3.0)

langchain PYPI version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - ai-rich =0.1.3, =1.0.0, =0.1.0, =0.0.4, =0.19.13, =0.3.1, =1.0.0, =0.1.0, =0.1.0a1, =0.3.49, =0.4.14 Source cves: CVE-2026-55443 Source...

gpt3discord (>=11.2.2, <=11.2.6), llm-repl (0.0.2) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.133)

langchain PYPI version 0.0.133 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - gpt3discord =11.2.2, =1.2.22, =1.3.11 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

ringgpt (>=0.1.0, <=0.1.4), yid-langchain-extensions (>=0.1.0, <=0.4.16) potentially affected by CVE-2026-55443 via langchain (0.0.202)

langchain PYPI version 0.0.202 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - ringgpt =0.1.0, =0.1.0, =0.4.16 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

act-workflow (>=4.8.2, <=4.8.399), agent-builder (0.0.1) +11 more potentially affected by CVE-2026-55443 via langchain (0.3.3)

langchain PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - act-workflow =4.8.2, =0.0.320, =0.0.4rc1, =0.1.0, =4.2.1, =0.1.6, =0.4.16, =0.4.15, =0.5.0, =0.5.1 Source cves: CVE-2026-55443 Source advisory...

arxivai (>=0.0.14, <=0.0.18), chatiq (1.0.0) +1 more potentially affected by CVE-2026-55443 via langchain (0.0.173)

langchain PYPI version 0.0.173 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - arxivai =0.0.14, =0.1.0, =0.2.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

ag-ui-langgraph (>=0.0.14, <=0.0.29), agent-builder (>=0.0.2, <=0.1.7) +136 more potentially affected by CVE-2026-55443 via langchain (>=1.0.0rc2, <=1.3.7)

langchain PYPI version =1.0.0rc2, =0.0.14, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.9.211, =0.1.0, =0.2.1, =0.2.0, =0.1.0, =0.1.0, =3.0.3, =3.1.0, =3.9.3 and more Source cves: CVE-2026-55443 Source advisory: GHSA-GR75-JV2W-4656...

brevia (>=0.0.8, <=0.0.12) potentially affected by CVE-2026-55443 via langchain (0.0.338)

langchain PYPI version 0.0.338 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - brevia =0.0.8, =0.0.12 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

codeinterpreterapi (>=0.0.1, <=0.0.8), pxgpt (0.0.0rc0) potentially affected by CVE-2026-55443 via langchain (0.0.232)

langchain PYPI version 0.0.232 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - codeinterpreterapi =0.0.1, =0.0.8 - pxgpt 0.0.0rc0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

chainge (>=0.0.1, <=0.0.1.4), devrewind (0.2.0) +6 more potentially affected by CVE-2026-55443 via langchain (0.0.325)

langchain PYPI version 0.0.325 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - chainge =0.0.1, =0.1.4, =0.2.0, =1.5.0, =0.1.48, =0.1.50 - vizro-ai 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-46...

langup (>=0.0.8, <=0.0.10) potentially affected by CVE-2026-55443 via langchain (0.0.286)

langchain PYPI version 0.0.286 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langup =0.0.8, =0.0.10 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

bugbug (>=0.0.546, <=0.0.548), flo-ai (0.0.1) +3 more potentially affected by CVE-2026-55443 via langchain (0.2.1)

langchain PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - bugbug =0.0.546, =0.1.2, =0.1.0, =0.0.8, =0.0.10 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

horde-client (>=1.0.2, <=1.0.3), rtdip-sdk (>=0.0.0, <=0.10.3) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.291)

langchain PYPI version 0.0.291 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - horde-client =1.0.2, =0.0.0, =0.0.18, =0.0.1, =0.0.12 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

langfuse (>=1.1.0, <=1.1.6) potentially affected by CVE-2026-55443 via langchain (0.0.320)

langchain PYPI version 0.0.320 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langfuse =1.1.0, =1.1.6 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

code-qa (>=0.1.0, <=0.3.1) potentially affected by CVE-2026-55443 via langchain (0.0.187)

langchain PYPI version 0.0.187 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - code-qa =0.1.0, =0.3.1 Source cves: CVE-2026-55443 Source advisory: OSV:GHSA-GR75-JV2W-4656...

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-54531 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-54531 Source advisory: OSV:GHSA-M2V9-299J-RV96...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-54530 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-54530 Source advisory: OSV:GHSA-52X6-GQ3R-VPF4...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-49460 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-49460 Source advisory: OSV:GHSA-5HGR-HG42-57JG...