langchain-core vulnerabilities — 18 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
8.2 high CVE-2026-44843: LangChain Unsafe Deserialization Vulnerability langchain-core PyPI 13 Jul 2026 0.3.85
5.3 medium CVE-2026-40087: LangChain Incomplete f-string Validation in Prompt Templates langchain-core PyPI 13 Jul 2026 0.3.84
3.7 low CVE-2026-26013: LangChain SSRF Vulnerability in ChatOpenAI Token Counting langchain-core PyPI 13 Jul 2026 1.2.11
8.3 high CVE-2025-65106: LangChain Template Injection Vulnerability in Prompt Templates langchain-core PyPI 07 Jul 2026 0.3.80
5.3 medium CVE-2024-10940: langchain-core Arbitrary File Read Vulnerability langchain-core PyPI 07 Jul 2026 0.1.53
5.9 medium CVE-2024-1455: LangChain XMLOutputParser Vulnerable to XML Entity Expansion langchain-core PyPI 07 Jul 2026 0.1.35
9.3 critical CVE-2025-68664: LangChain Serialization Injection Vulnerability Enables Secret Extraction langchain-core PyPI 29 Jun 2026 0.3.81
8.2 high CVE-2026-44843: LangChain Vulnerable to Unsafe Deserialization of Attacker-Controlled Objects langchain-core PyPI 08 May 2026 1.3.3
Unrated CVE-2026-34070: langchain-core Package Vulnerability Leading to Potential Security Risks langchain-core PyPI 16 Apr 2026 1.2.21+echo.1
5.3 medium Incomplete f-string Validation in LangChain Leads to Potential Data Exposure langchain-core PyPI 08 Apr 2026 0.3.84
7.5 high CVE-2026-34070: langchain-core Arbitrary File Read Vulnerability langchain-core PyPI 31 Mar 2026 1.2.22
7.5 high CVE-2026-34070: Path Traversal Vulnerability in langchain-core Package langchain-core PyPI 27 Mar 2026 1.2.22
3.7 low CVE-2026-26013: LangChain SSRF Vulnerability in ChatOpenAI Image Token Counting langchain-core PyPI 11 Feb 2026 1.2.11
9.3 critical CVE-2025-68664: LangChain Serialization Injection Vulnerability Allows Secret Extraction langchain-core PyPI 23 Dec 2025 1.2.5
8.3 high CVE-2025-65106: LangChain Template Injection Vulnerability in Prompt Templates langchain-core PyPI 20 Nov 2025 1.0.7
5.3 medium CVE-2024-10940: langchain-core Arbitrary File Read Vulnerability langchain-core PyPI 20 Mar 2025 0.1.53
5.9 medium CVE-2024-1455: LangChain's XMLOutputParser vulnerable to XML Entity Expansion langchain-core PyPI 26 Mar 2024 0.1.35
Unrated CVE-2024-28088: langchain-core - Directory Traversal Vulnerability langchain-core PyPI 04 Mar 2024 0.1.11
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.