@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92952 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92952 Source advisory: OSV:GHSA-JF8Q-945G-9Q4C...

@dataform/cli (>=3.0.59-alpha.1, <=3.0.71), @hiracky16/dataform-osmosis (>=0.1.0, <=0.1.6) +16 more potentially affected by CVE-2026-92935 via vm2 (>=3.11.4, <=3.11.6)

vm2 NPM version =3.11.4, =3.0.59-alpha.1, =0.1.0, =2.32.0, =1.8.2, =1.1.0, =0.2.0, =2.32.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.73.0, =1.74.12 and more Source cves: CVE-2026-92935 Source advisory: SNYK:JS-VM2-20043635...

@n8n/n8n-nodes-langchain (>=2.32.0, <=2.34.0) potentially affected by CVE-2026-77069 via n8n-nodes-base (>=2.32.0, <=2.34.0)

n8n-nodes-base NPM version =2.32.0, =2.32.0, =2.34.0 Source cves: CVE-2026-77069 Source advisory: SNYK:JS-N8NNODESBASE-20054036...

@n8n/n8n-nodes-langchain (>=2.32.0, <=2.33.1) potentially affected by CVE-2026-77076 via n8n-nodes-base (>=2.32.0, <=2.33.0)

n8n-nodes-base NPM version =2.32.0, =2.32.0, =2.33.1 Source cves: CVE-2026-77076 Source advisory: SNYK:JS-N8NNODESBASE-20186635...

@n8n/n8n-nodes-langchain (2.34.0) potentially affected by CVE-2026-77076 via n8n-nodes-base (2.34.0)

n8n-nodes-base NPM version 2.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.34.0 Source cves: CVE-2026-77076 Source advisory: SNYK:JS-N8NNODESBASE-20186635...

@n8n/ai-node-sdk (0.22.0), @n8n/ai-workflow-builder (1.32.0) +3 more potentially affected by CVE-2026-77085 via @n8n/ai-utilities (0.25.0)

@n8n/ai-utilities NPM version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/ai-utilities and may be impacted: - @n8n/ai-node-sdk 0.22.0 - @n8n/ai-workflow-builder 1.32.0 - @n8n/create-node 0.40.0 - @n8n/n8n-nodes-langchain 2.32.0 -...

@n8n/n8n-nodes-langchain (2.34.0) potentially affected by CVE-2026-77081 via n8n-nodes-base (2.34.0)

n8n-nodes-base NPM version 2.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.34.0 Source cves: CVE-2026-77081 Source advisory: SNYK:JS-N8NNODESBASE-20186634...

@n8n/n8n-nodes-langchain (>=2.32.0, <=2.33.1) potentially affected by CVE-2026-77081 via n8n-nodes-base (>=2.32.0, <=2.33.0)

n8n-nodes-base NPM version =2.32.0, =2.32.0, =2.33.1 Source cves: CVE-2026-77081 Source advisory: SNYK:JS-N8NNODESBASE-20186634...

User Impersonation

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to User Impersonation via the MicrosoftAgent365Trigger node failing to validate inbound requests. An attacker can execute workflows with attacker-controlled data by submitting forged payloads to the webhook UR...

Arbitrary File Upload

@n8n/n8n-nodes-langchain is vulnerable to Arbitrary File Upload. The vulnerability is due to improper validation and handling of uploaded files in the Chat Trigger component, which allows an attacker to upload a crafted HTML file and execute arbitrary code on the affected system...

Improper Validation of Specified Type of Input

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input that is passed to the handleFormData function. An attacker can gain unauthorized access to files on the underlying server by requests with unexpected...