Reproduce-CVE-2024-21513

Reproduce-CVE-2024-21513 Overview This project demonstrates the vulnerability CVE-2024-21513 in the langchain-experimental package, specifically in versions =0.0.15 and 0.0.21. The vulnerability allows arbitrary code execution via the VectorSQLDatabaseChain component when retrieving values from t...

Nmap-API

Nmap API 使用 python3.10、Debian、python-Nmap 和 Flask 框架创建一个 Nmap API，可以快速在线进行扫描，并且易于部署。 这是我们大学 PCL 项目的一个实现，该项目仍在开发中并持续更新。 API 参考 获取所有项目 root@kitploit: GET /api/p1/authkey/target GET /api/p2/authkey/target GET /api/p3/authkey/target GET /api/p4/authkey/target GET /api/p5/authkey/target 参数| 类型| 描述...

LangAlpha

面向 vibe investing 的 agent harness LangAlpha 帮你解读金融市场，辅助投资决策。 English ｜ 简体中文 ｜ 日本語 快速开始 • API 文档 • Agent 核心 • 后端 • 前端 • TUI • Skills • MCP 把 dashboard 里的精选新闻简报 pin 给 agent，让多个并行 subagent 扫描市场并生成选股思路——结果会回到对话内嵌的交互式 dashboard 里，给出五组贴合你持仓风格的多空配对交易思路。 为什么选择 LangAlpha 如今的 AI...

CVE-2024-8309

Prueba de Concepto para la Vulnerabilidad CVE-2024–8309 de Langchain Descripción general Esta configuración demuestra una prueba de concepto de la vulnerabilidad de inyección de prompts en la clase GraphCypherQAChain que permite la inyección de SQL en una base de datos Neo4j. Componentes: 1. Base...

CVE-2026-34070

Encontré un Bug de Path Traversal en LangChain Que Podría Filtrar Tus Credenciales en la Nube Cómo una API heredada olvidada en uno de los frameworks de IA más populares expuso silenciosamente millones de aplicaciones a lecturas arbitrarias de archivos. Hay una sensación particular que sientes...

CVE-2025-68664

CVE-2025-68664 Todo lo que quiero para Navidad son tus secretos: LangGrinch golpea el núcleo de LangChain CVE-2025-68664 Autor: Yarden Porat Investigación de Cyata: Vulnerabilidad LangGrinch en LangChain Publicado: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Ayer, LangChain...

LangChain-Core < 0.3.81 / 1.x < 1.2.5

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...

CVE-2024-21513

CVE-2024-21513 PoC para CVE-2024-21513 Exploit original documentado por Snyk Security Research Exploit CVE-2024-21513 es una vulnerabilidad en langchain-experimental donde los resultados no validados de consultas SQL se pasaban a eval de Python, permitiendo la ejecución remota de código mediante...

CVE-2025-68664-LangGrinch-PoC

!CWEhttps://img.shields.io/badge/CWE--502-%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-informational?style=for-the-badge&logo=owasp&logoColor=whit...

langgrinch-cve-2025-68664-analysis

Análisis de Vulnerabilidad LangGrinch: CVE-2025-68664 Resumen Este repositorio contiene un informe técnico que analiza CVE-2025-68664, también conocido como LangGrinch, una vulnerabilidad de inyección de serialización que afecta a LangChain Core. El informe explica los antecedentes de la...

LangAlpha v2026.09.01

A vibe investing agent harness LangAlpha is built to help interpret financial markets and support investment decisions. English ｜ 简体中文 ｜ 日本語 Getting Started • API Docs • Agent Core • Backend • Web • TUI • Skills • MCP Pin a curated news brief from the dashboard, kick off idea generation, and...

ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in langchain-core - Patched by Root

Root has patched CVE-2026-44843 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in langchain-core - Patched by Root

Root has patched CVE-2026-34070 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root

Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in langchain-core - Patched by Root

Root has patched CVE-2025-68664 in the langchain-core package for Root:PyPI. Multiple fixed versions available...

CVE-2026-72848

A flaw was found in langchain-community. An attacker who controls or influences an ingested sitemap can bypass domain restrictions in the SitemapLoader component by pointing a nested sitemap entry at an internal address. This allows the server to fetch internal resources even when...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +2041 more potentially affected by CVE-2026-72848 via langchain-community (>=0.0.1, <=1.0.0a1)

langchain-community PYPI version =0.0.1, =0.1.0, =0.1.0b1, =0.1.0, =0.1.0, =0.1.0, =4.8.2, =0.1.3, =0.1.0, =1.0.1, =0.1.0, =0.1.0, =3.2.0, =3.4.0 and more Source cves: CVE-2026-72848 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-19233333...

CVE-2026-72848

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...