Langchain Core vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

LC

Product

Langchain Core

by Langchain · last CVE Apr 9, 2026

5

CVEs

0

On KEV

9.1

Max CVSS

0

New 30D

Vulnerabilities5 In the news0 Timeline

Severity mix

Critical 1High 2Medium 1Low 1

Severity

All severities5 Critical1 High2 Medium1 Low1

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Langchain Core to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-68665	9.1	1%	Dec 23	LangChain serialization injection vulnerability enables secret extraction Affected: before 0.3.80; 1.0.0 before 1.1.8
CVE-2025-68664	8.2	43%	Dec 23	LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs Affected: before 0.3.81; 1.0.0 before 1.2.5
CVE-2026-34070	7.5	1%	Mar 31	LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions Affected: before 1.2.22
CVE-2026-40087	5.3	0%	Apr 9	LangChain has incomplete f-string validation in prompt templates Affected: before 0.3.84; 1.0.0 before 1.2.28
CVE-2026-26013	3.7	0%	Feb 10	LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages Affected: before 1.2.11