Search for packages
| purl | pkg:pypi/langchain-core@0.3.0.dev4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-61vg-ekxn-hqfv
Aliases: CVE-2026-26013 GHSA-2g6r-c272-w58r |
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages The `ChatOpenAI.get_num_tokens_from_messages()` method fetches arbitrary `image_url` values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. |
Affected by 2 other vulnerabilities. |
|
VCID-8fbt-6heb-uyg1
Aliases: CVE-2025-68664 GHSA-c67j-w6g6-q2cm |
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs A serialization injection vulnerability exists in LangChain's `dumps()` and `dumpd()` functions. The functions do not escape dictionaries with `'lc'` keys when serializing free-form dictionaries. The `'lc'` key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. |
Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-91ur-jaq8-xqcj
Aliases: CVE-2025-65106 GHSA-6qv9-48xg-fc7f |
Duplicate This advisory duplicates another. |
Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-z7kv-vrhw-1qad
Aliases: CVE-2026-40087 GHSA-926x-3r5x-gfhw |
langchain: incomplete f-string validation in prompt templates |
Affected by 1 other vulnerability. Affected by 2 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zb77-fwdy-dbfy
Aliases: CVE-2026-34070 GHSA-qh6h-p6c9-ff54 |
langchain: path traversal in legacy load_prompt functions in langchain-core |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||