800 matches found
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the EmbeddingSearchRequest.filter process. An attacker can access sensitive data, modify or delete database records, or cause denial of service by injecting crafted input into metadata filter keys or values, which are...
GHSA-GR75-JV2W-4656 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...
Symlink Attack
Overview langchain is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Symlink Attack via the file-search middleware and loaders that resolve filesystem paths and search patterns without confining the resolved path to the intended root...
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or t...
PT-2026-51373
Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.3.9 Description Several components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. This occurs in a file-search agent middlewar...
Malicious code in langchain-core-mcp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd42d83950d8d8fc559905eed104af38cd6c8aef683b96778f0b8d778dd6bd5a Package langchain-core-mcp impersonates the legitimate langchain-core publisher: METADATA sets Project-URL Repository to...
CVE-2026-7846
A vulnerability has been found in chatchat-space Langchain-Chatchat up to 0.3.1.3. Impacted is the function files of the file libs/chatchat-server/chatchat/server/apiserver/openairoutes.py of the component OpenAI-Compatible File Upload API. Such manipulation of the argument file.filename leads to...
CVE-2026-44843
A flaw was found in LangChain, a framework for building agents and large language model LLM-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially...
CVE-2026-30617
LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When...
ROOT-APP-NPM-CVE-2026-26019 CVE-2026-26019 in @rootio/langchain__community - Patched by Root
Root has patched CVE-2026-26019 in the @rootio/langchaincommunity package for Root:npm. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41481 CVE-2026-41481 in rootio-langchain-text-splitters - Patched by Root
Root has patched CVE-2026-41481 in the rootio-langchain-text-splitters package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in rootio-langchain-core - Patched by Root
Root has patched CVE-2025-68664 in the rootio-langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in rootio-langchain-core - Patched by Root
Root has patched CVE-2026-34070 in the rootio-langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in rootio-langchain-core - Patched by Root
Root has patched CVE-2026-44843 in the rootio-langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-40087 CVE-2026-40087 in rootio-langchain-core - Patched by Root
Root has patched CVE-2026-40087 in the rootio-langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-6985 CVE-2025-6985 in rootio-langchain-text-splitters - Patched by Root
Root has patched CVE-2025-6985 in the rootio-langchain-text-splitters package for Root:PyPI. Multiple fixed versions available...
GHSA-PJWX-R37V-7724 vulnerabilities
Vulnerabilities for packages: py3-langchain-core, py3-langchain...
CVE-2026-44843 vulnerabilities
Vulnerabilities for packages: py3-langchain-core, py3-langchain...
