Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:npm/%40langchain/community@0.2.20
Typenpm
Namespace@langchain
Namecommunity
Version0.2.20
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.1.18
Latest_non_vulnerable_version1.1.18
Affected_by_vulnerabilities
0
url VCID-2nga-r52m-hqcz
vulnerability_id VCID-2nga-r52m-hqcz
summary A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection. This vulnerability permits unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-7042
reference_id
reference_type
scores
0
value 0.00062
scoring_system epss
scoring_elements 0.1978
published_at 2026-06-14T12:55:00Z
1
value 0.00062
scoring_system epss
scoring_elements 0.19804
published_at 2026-06-13T12:55:00Z
2
value 0.00062
scoring_system epss
scoring_elements 0.19611
published_at 2026-06-11T12:55:00Z
3
value 0.00062
scoring_system epss
scoring_elements 0.19785
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-7042
1
reference_url https://github.com/langchain-ai/langchainjs
reference_id
reference_type
scores
0
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/langchain-ai/langchainjs
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-114.yaml
reference_id
reference_type
scores
0
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2024-114.yaml
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-7042
reference_id
reference_type
scores
0
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
2
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-7042
4
reference_url https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6
reference_id 615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6
reference_type
scores
0
value 4.9
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
2
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
3
value LOW
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-29T13:50:49Z/
url https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6
5
reference_url https://huntr.com/bounties/b612defb-1104-4fff-9fef-001ab07c7b2d
reference_id b612defb-1104-4fff-9fef-001ab07c7b2d
reference_type
scores
0
value 4.9
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
1
value 4.9
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
2
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
3
value LOW
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-29T13:50:49Z/
url https://huntr.com/bounties/b612defb-1104-4fff-9fef-001ab07c7b2d
6
reference_url https://github.com/advisories/GHSA-6m59-8fmv-m5f9
reference_id GHSA-6m59-8fmv-m5f9
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6m59-8fmv-m5f9
fixed_packages
0
url pkg:npm/%40langchain/community@0.3.3
purl pkg:npm/%40langchain/community@0.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bzjp-hhsv-4ugy
1
vulnerability VCID-x3c9-fqg9-87dd
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540langchain/community@0.3.3
aliases CVE-2024-7042, GHSA-6m59-8fmv-m5f9
risk_score 2.2
exploitability 0.5
weighted_severity 4.4
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-2nga-r52m-hqcz
1
url VCID-bzjp-hhsv-4ugy
vulnerability_id VCID-bzjp-hhsv-4ugy
summary LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019). Users should upgrade to `@langchain/community` 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating `Location` targets before following them. In this version, automatic redirects are disabled (`redirect: "manual"`), each 3xx `Location` is resolved and validated with `validateSafeUrl()` before the next request, and a maximum redirect limit prevents infinite loops.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27795.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-27795.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-27795
reference_id
reference_type
scores
0
value 0.00048
scoring_system epss
scoring_elements 0.15523
published_at 2026-06-14T12:55:00Z
1
value 0.00048
scoring_system epss
scoring_elements 0.15415
published_at 2026-06-11T12:55:00Z
2
value 0.00048
scoring_system epss
scoring_elements 0.15549
published_at 2026-06-12T12:55:00Z
3
value 0.00048
scoring_system epss
scoring_elements 0.15557
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-27795
2
reference_url https://github.com/langchain-ai/langchainjs
reference_id
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/langchain-ai/langchainjs
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2442693
reference_id 2442693
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2442693
4
reference_url https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee
reference_id 2812d2b2b9fd9343c4850e2ab906b8cf440975ee
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee
5
reference_url https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
reference_id %40langchain%2Fcommunity%401.1.14
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
6
reference_url https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18
reference_id %40langchain%2Fcommunity%401.1.18
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18
7
reference_url https://github.com/langchain-ai/langchainjs/pull/9990
reference_id 9990
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/pull/9990
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-27795
reference_id CVE-2026-27795
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-27795
9
reference_url https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
reference_id d5e3db0d01ab321ec70a875805b2f74aefdadf9d
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
10
reference_url https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
reference_id GHSA-gf3v-fwqg-4vh7
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
11
reference_url https://github.com/advisories/GHSA-mphv-75cg-56wg
reference_id GHSA-mphv-75cg-56wg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mphv-75cg-56wg
12
reference_url https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-mphv-75cg-56wg
reference_id GHSA-mphv-75cg-56wg
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-25T18:42:34Z/
url https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-mphv-75cg-56wg
fixed_packages
0
url pkg:npm/%40langchain/community@1.1.18
purl pkg:npm/%40langchain/community@1.1.18
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540langchain/community@1.1.18
aliases CVE-2026-27795, GHSA-mphv-75cg-56wg
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bzjp-hhsv-4ugy
2
url VCID-x3c9-fqg9-87dd
vulnerability_id VCID-x3c9-fqg9-87dd
summary LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26019.json
reference_id
reference_type
scores
0
value 4.1
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26019.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-26019
reference_id
reference_type
scores
0
value 0.00013
scoring_system epss
scoring_elements 0.02044
published_at 2026-06-11T12:55:00Z
1
value 0.00013
scoring_system epss
scoring_elements 0.02049
published_at 2026-06-12T12:55:00Z
2
value 0.00015
scoring_system epss
scoring_elements 0.03489
published_at 2026-06-14T12:55:00Z
3
value 0.00015
scoring_system epss
scoring_elements 0.03475
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-26019
2
reference_url https://github.com/langchain-ai/langchainjs
reference_id
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/langchain-ai/langchainjs
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2439181
reference_id 2439181
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2439181
4
reference_url https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
reference_id %40langchain%2Fcommunity%401.1.14
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-12T21:14:35Z/
url https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
5
reference_url https://github.com/langchain-ai/langchainjs/pull/9990
reference_id 9990
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-12T21:14:35Z/
url https://github.com/langchain-ai/langchainjs/pull/9990
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-26019
reference_id CVE-2026-26019
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-26019
7
reference_url https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
reference_id d5e3db0d01ab321ec70a875805b2f74aefdadf9d
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-12T21:14:35Z/
url https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
8
reference_url https://github.com/advisories/GHSA-gf3v-fwqg-4vh7
reference_id GHSA-gf3v-fwqg-4vh7
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gf3v-fwqg-4vh7
9
reference_url https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
reference_id GHSA-gf3v-fwqg-4vh7
reference_type
scores
0
value 4.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-12T21:14:35Z/
url https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
fixed_packages
0
url pkg:npm/%40langchain/community@1.1.14
purl pkg:npm/%40langchain/community@1.1.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bzjp-hhsv-4ugy
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540langchain/community@1.1.14
aliases CVE-2026-26019, GHSA-gf3v-fwqg-4vh7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-x3c9-fqg9-87dd
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:npm/%2540langchain/community@0.2.20