CVE Tools
Track your stack

Langchain

5 CVEs tracked since 2023. Since Aug 2023, none of them reached CISA KEV.

Langchain CVEs per month

Aug 2023 to Aug 2023. Point at a month, or focus the strip and use the arrow keys.
Langchain CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2023-0850

Products

The products that kept showing up in Langchain's monthly top three, with their CVEs summed over those months.

  1. Langchain51 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Langchain.

  1. CVE-2026-55443LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders5.1
  2. CVE-2026-48776LangGraph SDK has unsafe URL path construction4.2
  3. CVE-2026-48775LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading6.8
  4. CVE-2026-44843LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists8.2
  5. CVE-2026-41488angchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding3.1
  6. CVE-2026-41481LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass6.5
  7. CVE-2026-40190LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`5.6
  8. CVE-2026-40087LangChain has incomplete f-string validation in prompt templates5.3
  9. CVE-2026-34070LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions7.5
  10. CVE-2026-28277LangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loading6.8
  11. CVE-2026-27795LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader4.1
  12. CVE-2026-26019@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation4.1
  13. CVE-2024-58340LangChain <= 0.3.1 MRKLOutputParser ReDoS7.5
  14. CVE-2025-68665LangChain serialization injection vulnerability enables secret extraction8.6
  15. CVE-2025-68664LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs9.3

The record

Peak rank
#161 in Aug 2023
Busiest month shown
Aug 2023, 5 CVEs
Months with a KEV entry
0 since Aug 2023
Monthly snapshots
1 since 2023
Langchain's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store