Vulnerabilidades em langchain-ai

54 resultados
Análise Vexday

LangChain-AI apresenta 41 CVEs documentadas com apenas 1 crítica, mas com dinâmica preocupante: 10 vulnerabilidades publicadas nos últimos 90 dias indicam cadência acelerada de descobertas. Embora nenhuma esteja sob exploração ativa conhecida (KEV), a fraqueza dominante em desserialização insegura (CWE-502) representa risco significativo em ambientes de integração de modelos de IA. A concentração recente de vulnerabilidades sugere superfície de ataque em evolução que demanda monitoramento contínuo.

CVE-2026-55236MEDIUMlanggraph-api: Incomplete assistant authorization in LangGraph Server run creationEPSS 0.3%CVE-2026-104873HIGHLangGraph SDK custom auth silently ignores actions= on resource decoratorsEPSS 0.3%CVE-2026-27795MEDIUMLangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderEPSS 0.2%CVE-2025-64104HIGHLangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStoreEPSS 0.2%CVE-2026-14742LOWlangchain-ai langgraph Task Result Cache _cache.py _freeze weak hashEPSS 0.2%CVE-2026-48775MEDIUMLangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loadingEPSS 0.2%CVE-2025-8709HIGHSQL Injection in langchain-ai/langchainEPSS 0.2%CVE-2026-48776MEDIUMLangGraph SDK has unsafe URL path constructionEPSS 0.2%CVE-2026-41182MEDIUMLangSmith SDK: Streaming token events bypass output redactionEPSS 0.2%CVE-2026-55443MEDIUMLangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersEPSS 0.2%CVE-2026-45134HIGHLangSmith Client SDK: Public prompt pull deserializes untrusted manifests without trust boundary warningEPSS 0.2%CVE-2026-59152MEDIUMArbitrary server-side file read in LangSmith SDK TracingMiddlewareEPSS 0.2%CVE-2026-41488LOWangchain-openai: Image token counting SSRF protection can be bypassed via DNS rebindingEPSS 0.2%CVE-2026-115885MEDIUMLangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputEPSS 0.1%