langchainjs vulnerabilities

3 known vulnerabilities in langchainjs from LangChain AI. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  langchainjs: Server-Side Request Forgery

  CVE-2026-27795Feb 25, 2026LangChain AI

  LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the und

• 9.1 Critical severity

  langchainjs: Deserialization of Untrusted Data

  CVE-2025-68665Dec 23, 2025LangChain AI

  LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subseque

• 9.8 Critical severity

  langchain-ai/langchainjs: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-7042Oct 29, 2024LangChain AI

  A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, den