langchain-ai vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-118668 langgraph-api implements the LangGraph API for rapid development and testing.High 8.6 · Oct 28, 2026
• CVE-2026-104873 LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications.High 7.6 · Oct 2, 2026
• CVE-2026-55253 LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph.High 7.7 · Sep 14, 2026
• CVE-2026-72848 SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries.High 7.7 · Aug 20, 2026
• CVE-2026-45134 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform.High 7.1 · May 27, 2026
• CVE-2026-44843 LangChain is a framework for building agents and LLM-powered applications.High 8.2 · May 26, 2026
• CVE-2026-34070 LangChain is a framework for building agents and LLM-powered applications.High 7.5 · Mar 30, 2026
• CVE-2026-25750 Langchain Helm Charts are Helm charts for deploying Langchain applications on Kubernetes.High 8.5 · Mar 4, 2026
• CVE-2024-58340 LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.parse() method (libs/lHigh 8.7 · Jan 12, 2026
• CVE-2025-68665 LangChain is a framework for building LLM-powered applications.High 8.6 · Dec 23, 2025
• CVE-2025-68664 LangChain is a framework for building agents and LLM-powered applications.Critical 9.3 · Dec 23, 2025
• CVE-2025-67644 LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite).High 7.3 · Dec 10, 2025
• CVE-2025-65106 LangChain is a framework for building agents and LLM-powered applications.High 8.3 · Nov 21, 2025
• CVE-2025-64439 LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite).High 7.4 · Nov 7, 2025
• CVE-2025-64104 LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite).High 7.3 · Oct 29, 2025
• CVE-2025-8709 A SQL injection vulnerability exists in the langchain-ai/langchain repository, specifically in the LangGraph's SQLite store implementation.High 7.3 · Oct 26, 2025
• CVE-2025-6985 The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing.High 7.5 · Oct 6, 2025
• CVE-2025-6984 The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing.High 7.5 · Sep 4, 2025
• CVE-2025-2828 A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_communityCritical 10 · Jun 23, 2025
• CVE-2024-8309 A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection.Critical 9.8 · Oct 29, 2024
• CVE-2024-7774 A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5.Critical 9.1 · Oct 29, 2024
• CVE-2024-7042 A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leadingCritical 9.8 · Oct 29, 2024
• CVE-2024-5998 A vulnerability in the FAISS.deserialize_from_bytes function of langchain-ai/langchain allows for pickle deserialization of untrusted data.High 7.8 · Sep 17, 2024
• CVE-2024-3095 A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5.High 7.7 · Jun 6, 2024
• CVE-2024-3571 langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStoHigh 8.8 · Apr 15, 2024