langchain-anthropic (>=0.1.14rc1, <=0.1.15), langchain-openai (>=0.1.8rc1, <=0.1.21rc1) +1 more potentially affected by CVE-2026-26013 via langchain-core (0.3.0.dev5)

langchain-core PYPI version 0.3.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-anthropic =0.1.14rc1, =0.1.8rc1, =0.1.21rc1 - langserve 0.3.0.dev2 Source cves: CVE-2026-26013 Source advisory:...

CVE-2026-41488

A flaw was found in langchain-openai. A remote attacker could exploit a Time-of-Check to Time-of-Use TOCTOU vulnerability, also known as a DNS rebinding vulnerability. This occurs because the urltosize helper, used for image token counting, validates URLs for Server-Side Request Forgery SSRF...

algorin-cli (>=0.0.1, <=0.21.0), athina (>=1.6.24, <=1.6.33) +29 more potentially affected by CVE-2026-41488 via langchain-openai (0.0.8)

langchain-openai PYPI version 0.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - algorin-cli =0.0.1, =1.6.24, =0.1.1, =0.1.3, =1.2.0, =0.0.1, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-41488 Source...

hspylib-askai (1.0.9), jpl-rosa (>=1.0.0, <=1.0.2) +2 more potentially affected by CVE-2026-41488 via langchain-openai (0.1.14)

langchain-openai PYPI version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - hspylib-askai 1.0.9 - jpl-rosa =1.0.0, =1.0.2 - srai-langchain 0.1.0 - srai-telegrambot 0.16.0 Source cves: CVE-2026-41488 Sour...

span-explain (0.1.0) potentially affected by CVE-2026-41488 via langchain-openai (0.0.2)

langchain-openai PYPI version 0.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - span-explain 0.1.0 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

aiagents4pharma (>=1.0.0, <=1.44.0), memoripy (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-41488 via langchain-openai (0.2.5)

langchain-openai PYPI version 0.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - aiagents4pharma =1.0.0, =0.1.0, =0.1.2 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

rexia-ai (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-41488 via langchain-openai (0.1.9)

langchain-openai PYPI version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - rexia-ai =0.1.0, =0.2.0 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

joe2025-uv-project (>=0.1.0, <=0.3.0), meez (0.2.22) potentially affected by CVE-2026-41488 via langchain-openai (0.3.30)

langchain-openai PYPI version 0.3.30 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - joe2025-uv-project =0.1.0, =0.3.0 - meez 0.2.22 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

actscene-ocr (>=0.1.3, <=0.1.5), biomni-bridge (>=0.3.1, <=0.3.3) +9 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.28)

langchain-openai PYPI version 0.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - actscene-ocr =0.1.3, =0.3.1, =1.0.0.dev0, =0.2.10, =1.1.0, =0.1.0, =0.1.4, =0.1.0.dev20, =0.2.1rc1 Source cves: CVE-2026-41488...

diagram-to-iac (>=1.0.4, <=1.0.9), next-gen-ui-langgraph (>=0.2.0, <=0.4.0) +1 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.25)

langchain-openai PYPI version 0.3.25 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - diagram-to-iac =1.0.4, =0.2.0, =0.4.0 - next-gen-ui-testing 0.4.0 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-7...

catalog-agent (>=0.1.1, <=0.1.6), longtrainer (>=0.3.1, <=0.3.4) +2 more potentially affected by CVE-2026-41488 via langchain-openai (0.2.8)

langchain-openai PYPI version 0.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - catalog-agent =0.1.1, =0.3.1, =0.1.3, =0.1.4 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

ai-shell-agent (>=0.1.0, <=0.2.2), toolmate-lite (>=0.6.51, <=0.6.52) potentially affected by CVE-2026-41488 via langchain-openai (0.3.2)

langchain-openai PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - ai-shell-agent =0.1.0, =0.6.51, =0.6.52 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

bisheng-langchain (>=0.3.4, <=0.3.7.1), bsrag-langchain (0.3.8.0) +1 more potentially affected by CVE-2026-41488 via langchain-openai (0.1.5)

langchain-openai PYPI version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - bisheng-langchain =0.3.4, =0.1.4, =0.1.7 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

autonomous-agent (0.0.1), bugbug (>=0.0.553, <=0.0.554) +5 more potentially affected by CVE-2026-41488 via langchain-openai (0.1.22)

langchain-openai PYPI version 0.1.22 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - autonomous-agent 0.0.1 - bugbug =0.0.553, =1.0.5, =0.0.1, =0.3.0, =0.1.6, =0.1.1, =0.3.1 Source cves: CVE-2026-41488 Source...

beatrica (>=0.0.3, <=2025.5.71632), zetaforge (0.1.2) potentially affected by CVE-2026-41488 via langchain-openai (0.1.2)

langchain-openai PYPI version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - beatrica =0.0.3, =2025.5.71632 - zetaforge 0.1.2 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

agentbruno (>=0.0.2, <=0.0.5), ai-enterprise-agent (>=0.0.2, <=0.0.9) +3 more potentially affected by CVE-2026-41488 via langchain-openai (0.1.1)

langchain-openai PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - agentbruno =0.0.2, =0.0.2, =0.0.1, =0.9.0, =0.1.0, =0.1.17 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

epub-translator (0.0.1) potentially affected by CVE-2026-41488 via langchain-openai (0.3.13)

langchain-openai PYPI version 0.3.13 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - epub-translator 0.0.1 Source cves: CVE-2026-41488 Source advisory: OSV:PYSEC-2026-76...

abs-langchain-suite (>=0.1.0, <=0.3.1), acp-cli (>=0.0.1, <=0.0.804) +295 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.35)

langchain-openai PYPI version 0.3.35 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - abs-langchain-suite =0.1.0, =0.0.1, =0.0.1a1, =1.0.0rc1, =0.1.1, =0.0.1a0, =0.1.1, =0.0.3rc0, =0.0.805, =0.1.2, =0.0.1, =0.1.0...

core4ai (>=1.1.6, <=1.3.1), kno-sdk (>=0.1.0, <=1.4.10) +4 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.14)

langchain-openai PYPI version 0.3.14 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - core4ai =1.1.6, =0.1.0, =0.2.0, =1.0.1 - ragbuilder 0.1.6 - spart-prompt 1.0.0 Source cves: CVE-2026-41488 Source advisory:...

agentiacap (>=0.1.31, <=0.1.37), laclongagent (0.1.2) +5 more potentially affected by CVE-2026-41488 via langchain-openai (0.3.7)

langchain-openai PYPI version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-openai and may be impacted: - agentiacap =0.1.31, =0.1.0, =1.0.0, =0.1.9, =0.0.18, =0.0.1, =0.0.9b0 Source cves: CVE-2026-41488 Source advisory:...