langchain-core vulnerabilities
CVEs whose affected-version data names the langchain-core package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-44843High· 8.2LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
▾ Twilightlangchain-core · langchain-coreEPSS 0.41%via OSV
CVE-2026-40087Medium· 5.3LangChain has incomplete f-string validation in prompt templates
LangChain has incomplete f-string validation in prompt templates
▾ Sunlitlangchain-core · langchain-coreEPSS 0.26%via OSV
CVE-2026-26013Low· 3.7LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
▾ Sunlitlangchain-core · langchain-coreEPSS 0.39%via OSV
CVE-2025-65106HighLangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
▾ Twilightlangchain-core · langchain-coreEPSS 0.51%via OSV
CVE-2024-10940Medium· 5.3langchain-core allows unauthorized users to read arbitrary files from the host file system
langchain-core allows unauthorized users to read arbitrary files from the host file system
▾ Sunlitlangchain-core · langchain-coreEPSS 0.39%via OSV
CVE-2024-1455Medium· 5.9LangChain's XMLOutputParser vulnerable to XML Entity Expansion
LangChain's XMLOutputParser vulnerable to XML Entity Expansion
▾ Sunlitlangchain-core · langchain-coreEPSS 0.77%via OSV