LA
Product
Langchain
28
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 15High 10Medium 3Low 0
Watch
Add Langchain to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-2828 | 10.0 | Jun 23 | SSRF Vulnerability in RequestsToolkit in langchain-ai/langchain Affected: before 0.0.28 |
| CVE-2024-8309 | 9.8 | Oct 29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection Affected: 0.2.5 |
| CVE-2024-7042 | 9.8 | Oct 29 | A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this class allows for prompt injection, leading to SQL injection Affected: before 0.3.1 |
| CVE-2024-2057 | 9.8 | Mar 1 | A vulnerability was found in LangChain langchain_community 0.0.26 Affected: 0.0.26 |
| CVE-2023-39631 | 9.8 | Sep 1 | An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library Affected: 0.0.245 |
| CVE-2023-36281 | 9.8 | Aug 22 | An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt Affected: 0.0.171 |
| CVE-2023-39659 | 9.8 | Aug 15 | An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component Affected: through 0.0.232 |
| CVE-2023-38896 | 9.8 | Aug 15 | An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions Affected: through 0.0.194 |
| CVE-2023-38860 | 9.8 | Aug 15 | An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter Affected: 0.0.231 |
| CVE-2023-36095 | 9.8 | Aug 5 | An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt… Affected: 0.0.194 |
| CVE-2023-36188 | 9.8 | Jul 6 | An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method Affected: 0.0.64 |
| CVE-2023-36258 | 9.8 | Jul 3 | An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be used Affected: 0.0.199 |
| CVE-2023-34541 | 9.8 | Jun 20 | Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt Affected: 0.0.171 |
| CVE-2023-34540 | 9.8 | Jun 14 | Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper) Affected: 0.0.171 |
| CVE-2023-29374 | 9.8 | Apr 5 | In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec method Affected: through 0.0.131 |
Showing 15