Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-98xf-r82g-9mhx
  • npm/@langchain/langgraph-checkpoint-mongodb
 LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state access 12 Jun
  • Fix available
  • Severity - 6.7 (Medium)
GHSA-3644-q5cj-c5c7
  • PyPI/langchain
  • PyPI/langchain-classic
  • PyPI/langsmith
  • npm/langsmith
 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning 13 May
  • Fix available
  • Severity - 7.1 (High)
GHSA-mphv-75cg-56wg
  • npm/@langchain/community
 LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader 25 Feb
  • Fix available
  • Severity - 4.1 (Medium)
GHSA-5mx2-w598-339m
  • npm/@langchain/langgraph-checkpoint-redis
 RediSearch Query Injection in @langchain/langgraph-checkpoint-redis 18 Feb
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-gf3v-fwqg-4vh7
  • npm/@langchain/community
 @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation 11 Feb
  • Fix available
  • Severity - 4.1 (Medium)
GHSA-r399-636x-v7f6
  • npm/@langchain/core
  • npm/langchain
 LangChain serialization injection vulnerability enables secret extraction 23 Dec 2025
  • Fix available
  • Severity - 8.6 (High)
GHSA-v2x8-97xq-8xrr
  • npm/@n8n/n8n-nodes-langchain
 N8N's Chat Trigger component is vulnerable to XSS 08 Sep 2025
  • Fix available
  • Severity - 8.8 (High)
MAL-2025-6115
  • npm/paypal-examples-langchain
 Malicious code in paypal-examples-langchain (npm) 22 Jul 2025
  • No fix available
MAL-2025-635
  • npm/auth0-langchain-rag-js
 Malicious code in auth0-langchain-rag-js (npm) 30 Jan 2025
  • No fix available
GHSA-6m59-8fmv-m5f9
  • npm/@langchain/community
 @langchain/community SQL Injection vulnerability 29 Oct 2024
  • Fix available
  • Severity - 2.1 (Low)
GHSA-hc5w-c9f8-9cc4
  • npm/langchain
 Langchain Path Traversal vulnerability 29 Oct 2024
  • Fix available
  • Severity - 6.9 (Medium)