EUVD-2023-0110

Malicious code in bioql PyPI...

EUVD-2025-19479

Malicious code in bioql PyPI...

PT-2025-27354

Name of the Vulnerable Software and Affected Versions: Langchain-Chatchat versions up to 0.3.1 Description: A critical vulnerability has been found in Langchain-Chatchat, affecting the upload temp docs function of the /knowledge base/upload temp docs file in the Backend component. The manipulatio...

langchain-core allows unauthorized users to read arbitrary files from the host file system

A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...

CVE-2024-10940

The CVE-2024-10940 vulnerability affects langchain-core in versions >=0.1.17,=0.2.0,=0.3.0,

CVE-2024-10940 Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain

A vulnerability in langchain-core versions =0.1.17,=0.2.0,=0.3.0,0.3.15 allows unauthorized users to read arbitrary files from the host file system. The issue arises from the ability to create langchaincore.prompts.ImagePromptTemplate's and by extension langchaincore.prompts.ChatPromptTemplate's...

Deserialization Of Untrusted Data

Langchain is vulnerable to Deserialization of Untrusted Data. The vulnerability is caused due to improper deserialization of untrusted pickle data in the FAISS.deserializefrombytes function, which allows execution of arbitrary commands via os.system...

CVE-2023-34540

Langchain before v0.0.225 was discovered to contain a remote code execution RCE vulnerability in the component JiraAPIWrapper aka the JIRA API wrapper. This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available...