66 matches found
langgrinch-cve-2025-68664-analysis
LangGrinch Vulnerability Analysis: CVE-2025-68664 Overview This repository contains a technical report analyzing CVE-2025-68664, also known as LangGrinch, a serialization injection vulnerability affecting LangChain Core. The report explains the vulnerability background, root cause, exploitation...
CVE-2026-34070
I Found a Path Traversal Bug in LangChain That Could Leak Your Cloud Credentials How a forgotten legacy API in one of AI's most popular frameworks quietly exposed millions of applications to arbitrary file reads. There's a certain feeling you get when a proof-of-concept works on the first try. No...
CVE-2025-68664
CVE-2025-68664 All I Want for Christmas Is Your Secrets: LangGrinch Strikes LangChain Core CVE-2025-68664 Author: Yarden Porat Cyata Research: LangGrinch Vulnerability in LangChain Published: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ Yesterday LangChain published a critical...
LangChain-Core < 0.3.81 / 1.x < 1.2.5
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...
ROOT-APP-PYPI-CVE-2025-65106 CVE-2025-65106 in langchain-core - Patched by Root
Root has patched CVE-2025-65106 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34070 CVE-2026-34070 in langchain-core - Patched by Root
Root has patched CVE-2026-34070 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-68664 CVE-2025-68664 in langchain-core - Patched by Root
Root has patched CVE-2025-68664 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44843 CVE-2026-44843 in langchain-core - Patched by Root
Root has patched CVE-2026-44843 in the langchain-core package for Root:PyPI. Multiple fixed versions available...
CLSA-2026-1781571263 TuxCare security update for langchain-core (1 CVE)
TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post2+tuxcare...
CLSA-2026-1776126826 TuxCare security update for langchain-core (1 CVE)
TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post1+tuxcare...
PT-2026-74435
TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post1+tuxcare...
PT-2026-75062
TuxCare rebuilt langchain-core to address 1 CVE. Fixed in 0.3.83.post2+tuxcare...
Malicious code in langchain-core-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of langchain-core-mcp were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials...
PYSEC-2026-1070 Malicious code in langchain-core-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of langchain-core-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates...
PYSEC-2026-1517 langchain-core allows unauthorized users to read arbitrary files from the host file system
A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...
langchain-core allows unauthorized users to read arbitrary files from the host file system
A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...
Security Bulletin: Maximo AI Service uses langchain_core-0.3.81-py3-none-any.whl which is vulnerable to CVE-2026-26013.
Summary Maximo AI Service uses langchaincore-0.3.81-py3-none-any.whl which is vulnerable to CVE-2026-26013. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-26013 DESCRIPTION: LangChain is a framework for building agents and...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses pdfminersix-20251107-py3-none-any.whl, requests-2.32.5-py3-none-any.whl, langchaincore-0.3.81-py3-none-any.whl, pythondotenv-1.0.1-py3-none-any.whl, langchaintextsplitters-0.3.11-py3-none-any.whl, qs-6.15.1.tgz, idna-3.10-py3-none-any.whl, idna-3.14-py3-none-any.whl...
Malicious code in langchain-core-mcp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd42d83950d8d8fc559905eed104af38cd6c8aef683b96778f0b8d778dd6bd5a Package langchain-core-mcp impersonates the legitimate langchain-core publisher: METADATA sets Project-URL Repository to...
