Langchain Core vulnerabilities

3 known vulnerabilities in Langchain Core from LangChain. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  langchain: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-34070Mar 31, 2026LangChain AIEPSS 1.44%

  LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal

• 9.1 Critical severity

  langchainjs: Deserialization of Untrusted Data

  CVE-2025-68665Dec 23, 2025LangChain AI

  LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subseque

• 8.2 High severity

  langchain: Deserialization of Untrusted Data

  CVE-2025-68664Dec 23, 2025LangChain AIEPSS 42.9%

  LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys