LA
Product
Langchain
28
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 15High 10Medium 3Low 0
Watch
Add Langchain to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-3571 | 8.8 | Apr 16 | Path Traversal in langchain-ai/langchain Affected: 0.0.351 |
| CVE-2023-46229 | 8.8 | Oct 19 | LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server Affected: before 0.0.317 |
| CVE-2026-44843 | 8.2 | May 26 | LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists Affected: before 0.3.85; 1.0.0 before 1.3.3 |
| CVE-2024-28088 | 8.1 | Mar 3 | LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call Affected: before 0.1.12 |
| CVE-2024-0243 | 8.1 | Feb 24 | Server-side Request Forgery In Recursive URL Loader Affected: before 0.1.0 |
| CVE-2024-5998 | 7.8 | Sep 17 | Deserialization of Untrusted Data in langchain-ai/langchain Affected: before 0.2.9 |
| CVE-2024-3095 | 7.7 | Jun 6 | SSRF in Langchain Web Research Retriever in langchain-ai/langchain Affected: 0.1.5 before 0.2.9 |
| CVE-2024-58340 | 7.5 | Jan 12 | LangChain <= 0.3.1 MRKLOutputParser ReDoS Affected: through 0.3.1 |
| CVE-2023-32786 | 7.5 | Oct 20 | In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting… Affected: through 0.0.155 |
| CVE-2023-36189 | 7.5 | Jul 6 | SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component Affected: 0.0.64 |
Showing 10