LangChain vulnerabilities
We track 26 vulnerabilities in LangChain products across 8 products. 26 are rated high or critical, and none are known to be exploited. The most recent was published on June 17, 2026.
Latest LangChain vulnerabilities
- 9.1 Critical severity
langchain-ai: Improper Limitation of a Pathname to a Restricted Directory
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values use
- 9.8 Critical severity
langsmith-sdk: Improperly Controlled Modification of Object Prototype Attributes
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssign
- 7.5 High severity
langchain: Improper Limitation of a Pathname to a Restricted Directory
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal
- 8.1 High severity
helm: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes. Prior to langchain-ai/helm version 0.12.71, a URL parameter injection vulnerability existed in LangSmith Studio that could allow unauthorized access to user accounts thro
- 7.4 High severity
langchainjs: Server-Side Request Forgery
LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the und
- 9.1 Critical severity
langchainjs: Deserialization of Untrusted Data
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subseque
- 8.2 High severity
langchain: Deserialization of Untrusted Data
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys
- 7.8 High severity
langgraph: Improper Neutralization of Special Elements used in an SQL Command
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and below are vulnerable to SQL injection through the checkpoint implementation. Checkpoint allows attackers
- 10.0 Critical severity
langchain-ai/langchain: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vuln
- 9.1 Critical severity
langchain-ai/langchainjs: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read `.txt` files, and delete files. The v
- 9.8 Critical severity
langchain-ai/langchainjs: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, den
- 9.8 Critical severity
langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows…
langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbe
- 7.8 High severity
langchain-ai/langchain: Deserialization of Untrusted Data
A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data. This can lead to the execution of arbitrary commands via the os.system function. The issue affects the latest version of
- 8.5 High severity
langchain-experimental: Improper Control of Generation of Code
Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving values from the database, the code will attempt to call 'eval' on all values. An attacker can exploit this vulnerability and
- 7.8 High severity
langchain_experimental: Incorrect Default Permissions
langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step. NOTE; this issue exists because of an incomplete fix for CVE-2024-27444.
- 7.7 High severity
langchain-ai/langchain: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allo
- 8.1 High severity
langchain: Improper Limitation of a Pathname to a Restricted Directory
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub rep
- 9.8 Critical severity
langchain_community: Server-Side Request Forgery
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation l
- 9.8 Critical severity
langchain_experimental: Exposed Dangerous Method or Function
langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or
- 8.1 High severity
langchain-ai/langchain: Server-Side Request Forgery
With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in c
- 7.5 High severity
Langchain: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.
- 8.8 High severity
Langchain: Server-Side Request Forgery
LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.
- 9.8 Critical severity
Langchain: Improper Control of Generation of Code
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.
- 9.8 Critical severity
Langchain: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.
- 9.8 Critical severity
Langchain: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.
- 9.8 Critical severity
Langchain: Improper Control of Generation of Code
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.