Vulnerabilidades em langchain-ai
47 resultadosAnálise Vexday
LangChain-AI apresenta 41 CVEs documentadas com apenas 1 crítica, mas com dinâmica preocupante: 10 vulnerabilidades publicadas nos últimos 90 dias indicam cadência acelerada de descobertas. Embora nenhuma esteja sob exploração ativa conhecida (KEV), a fraqueza dominante em desserialização insegura (CWE-502) representa risco significativo em ambientes de integração de modelos de IA. A concentração recente de vulnerabilidades sugere superfície de ataque em evolução que demanda monitoramento contínuo.
CVE-2025-68664CRITICALLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsEPSS 42.9%CVE-2025-2828HIGHSSRF Vulnerability in RequestsToolkit in langchain-ai/langchainEPSS 21.0%CVE-2024-8309MEDIUMSQL Injection in langchain-ai/langchainEPSS 13.7%CVE-2025-67644HIGHLangGraph SQLite Checkpoint is vulnerable to SQL Injection via metadata filter key in checkpointer list methodEPSS 2.3%CVE-2024-3571MEDIUMPath Traversal in langchain-ai/langchainEPSS 1.9%CVE-2025-6984HIGHSensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchainEPSS 1.6%CVE-2026-34070HIGHLangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functionsEPSS 1.2%CVE-2026-27794MEDIUMLangGraph: BaseCache Deserialization of Untrusted Data may lead to Remote Code ExecutionEPSS 1.0%CVE-2025-64439HIGHLangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializerEPSS 0.9%CVE-2025-68665HIGHLangChain serialization injection vulnerability enables secret extractionEPSS 0.8%CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2024-3095MEDIUMSSRF in Langchain Web Research Retriever in langchain-ai/langchainEPSS 0.7%CVE-2026-48775MEDIUMLangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loadingEPSS 0.7%CVE-2026-28277MEDIUMLangGraph: Unsafe msgpack deserialization in LangGraph checkpoint loadingEPSS 0.6%CVE-2024-7774MEDIUMPath Traversal in langchain-ai/langchainjsEPSS 0.6%CVE-2026-55253HIGHLangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureEPSS 0.5%CVE-2026-72848HIGHlangchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request ForgeryEPSS 0.5%CVE-2024-0243LOWServer-side Request Forgery In Recursive URL LoaderEPSS 0.5%CVE-2025-65106HIGHLangChain Vulnerable to Template Injection via Attribute Access in Prompt TemplatesEPSS 0.5%CVE-2025-6985HIGHXXE Vulnerability in langchain-ai/langchainEPSS 0.5%