Vulnerabilities in langchain-ai
54 resultsCVE-2026-55236MEDIUMlanggraph-api: Incomplete assistant authorization in LangGraph Server run creationEPSS 0.3%CVE-2026-104873HIGHLangGraph SDK custom auth silently ignores actions= on resource decoratorsEPSS 0.3%CVE-2026-27795MEDIUMLangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderEPSS 0.2%CVE-2025-64104HIGHLangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStoreEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2026-48775MEDIUMLangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loadingEPSS 0.2%CVE-2025-8709HIGHSQL Injection in langchain-ai/langchainEPSS 0.2%CVE-2026-48776MEDIUMLangGraph SDK has unsafe URL path constructionEPSS 0.2%CVE-2026-41182MEDIUMLangSmith SDK: Streaming token events bypass output redactionEPSS 0.2%CVE-2026-55443MEDIUMLangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersEPSS 0.2%CVE-2026-45134HIGHLangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warningEPSS 0.2%CVE-2026-59152MEDIUMArbitrary server-side file read in LangSmith SDK TracingMiddlewareEPSS 0.2%CVE-2026-41488LOWangchain-openai: Image token counting SSRF protection can be bypassed via DNS rebindingEPSS 0.2%CVE-2026-115885MEDIUMLangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputEPSS 0.1%