langchain-ai has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 4. The median CVSS is 6.0 (medium). None have a confirmed exploitation report. Most affected products: langgraph (3), langchain-community (1), langchain-mongodb (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.0
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Products
- langgraph 3
- langchain-community 1
- langchain-mongodb 1
- langchainjs 1
- langgraph-api 1
Worst active — by depth score
CVE-2026-72848High· 8.6SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries59CVE-2026-104873High· 7.6LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications42CVE-2026-55253High· 7.7LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph42CVE-2026-115883Medium· 6.0LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores33CVE-2026-106119Medium· 6.0LangChain is a framework for building LLM-powered applications33
langchain-ai vulnerabilities
CVEs affecting langchain-ai, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-115885Medium· 4.1LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a temporary registry push token on standard input to docker login --password-stdin, but the CLI subproces…
CVE-2026-115883Medium· 6.0LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, …
CVE-2026-106119Medium· 6.0LangChain is a framework for building LLM-powered applications
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to b…
CVE-2026-104873High· 7.6LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.t…
CVE-2026-55253High· 7.7LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), MongoDBSaver.alist(), and MongoDBStore.search()…
CVE-2026-55236Medium· 5.9langgraph-api implements the LangGraph API for rapid development and testing
langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, the langgraph-api run-creation path authorizes the assistant attached to a run by dispatching assistants.search with an incomplete value inste…
CVE-2026-72848High· 8.6PoCSitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries
SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over …