langchain-core vulnerabilities
CVEs whose affected-version data names the langchain-core package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-40087Medium· 5.3LangChain has incomplete f-string validation in prompt templates
LangChain has incomplete f-string validation in prompt templates
▾ Sunlitlangchain-core · langchain-coreEPSS 0.26%via OSV
CVE-2026-26013Low· 3.7LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
▾ Sunlitlangchain-core · langchain-coreEPSS 0.43%via OSV
CVE-2025-68664Critical· 9.3PoCLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
▾ Abyssallangchain-core · langchain-coreEPSS 43%via OSV
CVE-2024-10940Medium· 5.3langchain-core allows unauthorized users to read arbitrary files from the host file system
langchain-core allows unauthorized users to read arbitrary files from the host file system
▾ Sunlitlangchain-core · langchain-coreEPSS 0.40%via OSV
CVE-2024-1455Medium· 5.9LangChain's XMLOutputParser vulnerable to XML Entity Expansion
LangChain's XMLOutputParser vulnerable to XML Entity Expansion
▾ Sunlitlangchain-core · langchain-coreEPSS 0.76%via OSV