GHSA-QH6H-P6C9-FF54 vulnerabilities

Vulnerabilities for packages: py3-langchain...

GHSA-926X-3R5X-GFHW vulnerabilities

Vulnerabilities for packages: open-webui, py3-langchain...

CVE-2026-40087 vulnerabilities

Vulnerabilities for packages: open-webui, py3-langchain...

CVE-2026-34070 vulnerabilities

Vulnerabilities for packages: py3-langchain...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2026-40260 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2026-40260 Source advisory: OSV:GHSA-3CRG-W4F6-42MX...

CVE-2026-40087

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...

CVE-2026-40087 LangChain has incomplete f-string validation in prompt templates

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...

CVE-2026-40087

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...

CVE-2026-40087

LangChain CVE-2026-40087 affects the f-string prompt-template validation prior to versions 0.3.84 and 1.2.28. The vulnerability arises because DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and evaluate them during formatting,...

CVE-2026-40087 LangChain has incomplete f-string validation in prompt templates

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...

CVE-2026-40087 LangChain has incomplete f-string validation in prompt templates

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1123 more potentially affected by CVE-2026-40087 via langchain-core (>=0.0.1, <=0.3.83)

langchain-core PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =3.2.0, =2.1.7, =0.0.2, =0.0.5 - agentc-langchain 1.0.0 and more Source cves: CVE-2026-40087 Source advisory: MEND:CVE-2026-40087...

accessiqlue (2025.12.21154255), agent-builder (>=0.0.2, <=0.1.7) +338 more potentially affected by CVE-2026-40087 via langchain-core (>=1.0.0a8, <=1.2.24)

langchain-core PYPI version =1.0.0a8, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.1 - ai-benchmark-analyzer 2025.12.21193050 - ai-claim-essence 2025.12.20202921 - ai-design-insights 2025.12.21145447 - ai-mysql-translator 2025.12.21101721 - ai-reliability-analyzer 2025.12.21171415 - ai-risk-extractor...

Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem

Summary Multiple vulnerabilities were addressed in IBM watsonx Code Assistant On Prem V5.3.1 Patch 1 Vulnerability Details CVEID:CVE-2024-58340 DESCRIPTION: LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service ReDoS vulnerability in the MRKLOutputParser.pars...

CVE-2026-40087: Improper Neutralization of Special Elements Used in a Template Engine

LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same...

LangChain security vulnerabilities

LangChain is an open-source framework developed by LangChain for creating applications powered by large language models LLMs. Versions of LangChain prior to 0.3.84 and 1.2.28 contained security vulnerabilities. These vulnerabilities stemmed from incomplete validation of f-string template fields,...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1122 more potentially affected by CVE-2026-40087 via langchain-core (>=0.0.1, <=0.3.81)

langchain-core PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =3.2.0, =2.1.7, =0.0.2, =0.0.5 - agentc-langchain 1.0.0 and more Source cves: CVE-2026-40087 Source advisory: GHSA-926X-3R5X-GFHW...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1123 more potentially affected by CVE-2026-40087 via langchain-core (>=0.0.1, <=0.3.83)

langchain-core PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =3.2.0, =2.1.7, =0.0.2, =0.0.5 - agentc-langchain 1.0.0 and more Source cves: CVE-2026-40087 Source advisory: OSV:GHSA-926X-3R5X-GFHW...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +1123 more potentially affected by CVE-2026-40087 via langchain-core (>=0.0.1, <=0.3.83)

langchain-core PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =3.2.0, =2.1.7, =0.0.2, =0.0.5 - agentc-langchain 1.0.0 and more Source cves: CVE-2026-40087 Source advisory: SNYK:PYTHON-LANGCHAINCORE-15953340...

accessiqlue (2025.12.21154255), agent-builder (>=0.0.2, <=0.1.7) +348 more potentially affected by CVE-2026-40087 via langchain-core (>=0.4.0.dev0, <=1.2.24)

langchain-core PYPI version =0.4.0.dev0, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.1 - ai-benchmark-analyzer 2025.12.21193050 - ai-claim-essence 2025.12.20202921 - ai-design-insights 2025.12.21145447 - ai-mysql-translator 2025.12.21101721 - ai-reliability-analyzer 2025.12.21171415 - ai-risk-extractor...