Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/langchain-openai@0.2.0.dev0
purl pkg:pypi/langchain-openai@0.2.0.dev0
Next non-vulnerable version 1.1.14
Latest non-vulnerable version 1.1.14
Risk 1.6
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-8mrq-f3bg-nqhy
Aliases:
CVE-2026-41488
GHSA-r7w7-9xr2-qq2r
PYSEC-2026-76
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could resolve to a public IP during validation and then to a private/localhost IP during the actual fetch.
1.1.14
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-31T09:47:54.357674+00:00 PyPI Importer Affected by VCID-8mrq-f3bg-nqhy https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip 38.6.0
2026-05-30T20:38:17.957529+00:00 Pypa Importer Affected by VCID-8mrq-f3bg-nqhy https://github.com/pypa/advisory-database/blob/main/vulns/langchain-openai/PYSEC-2026-76.yaml 38.6.0