Login Request a demo
Low severity · published Feb 10, 2026
CVE-2026-26013
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langchain · langchain-ai
< 1.2.11 · source: vendor
LC
Langchain Core · Langchain
before 1.2.11 · source: NVD
Affected product
LA
langchain
langchain-ai
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-26013
Patch
https://github.com/langchain-ai/langchain/commit/2b4b1dc29a833d4053deba4c2b77a3848c834565
Product
https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.11
Mitigation
https://github.com/langchain-ai/langchain/security/advisories/GHSA-2g6r-c272-w58r
More from langchain
8.3
CVE-2025-65106
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
8.2
CVE-2026-44843
LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
8.2
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
7.5
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
7.5
CVE-2024-58340
LangChain <= 0.3.1 MRKLOutputParser ReDoS