HIGH7.1PyPInpm
GHSA-3644-q5cj-c5c7· CVE-2026-45134, PYSEC-2026-2555LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Modified: 9/10/2026
package
PyPI/langchain
pkg:pypi/langchain
CRITICAL9.8PyPI
GHSA-2qmj-7962-cjq8· CVE-2023-36258, PYSEC-2023-98langchain arbitrary code execution vulnerability
Modified: 11/22/2024
MEDIUM4.2PyPI
GHSA-3hjh-jh2h-vrg6· CVE-2024-2965, PYSEC-2024-118Denial of service in langchain-community
Modified: 7/13/2026
MEDIUM4.9PyPI
GHSA-45pg-36p6-83v9· CVE-2024-8309, PYSEC-2024-115Langchain SQL Injection vulnerability
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-57fc-8q82-gfp3· CVE-2023-36188, PYSEC-2023-109langchain vulnerable to arbitrary code execution
Modified: 7/6/2026
HIGH8.8PyPI
GHSA-655w-fm8m-m478· CVE-2023-46229, PYSEC-2023-205LangChain Server Side Request Forgery vulnerability
Modified: 9/30/2024
CRITICAL9.8PyPI
GHSA-6643-h7h5-x9wh· CVE-2023-34541, PYSEC-2023-92Langchain vulnerable to arbitrary code execution
Modified: 12/7/2024
HIGH7.5PyPI
GHSA-6h8p-4hx9-w66c· CVE-2023-32786, PYSEC-2026-1508Langchain Server-Side Request Forgery vulnerability
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-7gfq-f96f-g85j· CVE-2023-36281, PYSEC-2023-151langchain vulnerable to arbitrary code execution
Modified: 9/30/2024
HIGH7.5PyPI
GHSA-7q94-qpjr-xpgm· CVE-2023-36189, PYSEC-2023-110langchain SQL Injection vulnerability
Modified: 10/21/2024
CRITICAL9.8PyPI
GHSA-8h5w-f6q9-wg35· CVE-2023-32785, PYSEC-2026-372Langchain SQL Injection vulnerability
Modified: 6/29/2026
CRITICAL9.8PyPI
GHSA-92j5-3459-qgp4· CVE-2023-38896, PYSEC-2023-146LangChain vulnerable to arbitrary code execution
Modified: 9/27/2024
CRITICAL9.8PyPI
GHSA-f73w-4m7g-ch9x· CVE-2023-39631, PYSEC-2023-162Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library
Modified: 2/20/2025
CRITICAL9.8PyPI
GHSA-fj32-q626-pjjc· CVE-2023-38860, PYSEC-2023-145LangChain vulnerable to arbitrary code execution
Modified: 9/27/2024
CRITICAL9.8PyPI
GHSA-fprp-p869-w6q2· CVE-2023-29374, PYSEC-2023-18LangChain vulnerable to code injection
Modified: 2/12/2025
MEDIUM5.1PyPI
GHSA-gr75-jv2w-4656· CVE-2026-55443, PYSEC-2026-2192LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-gwqq-6vq7-5j86· CVE-2023-36095, PYSEC-2023-138langchain Code Injection vulnerability
Modified: 9/27/2024
LOWPyPI
GHSA-h59x-p739-982c· CVE-2024-28088, PYSEC-2024-43LangChain directory traversal vulnerability
Modified: 12/3/2024
LOW3.7PyPI
GHSA-h9j7-5xvc-qhg5· CVE-2024-0243, PYSEC-2024-235langchain Server-Side Request Forgery vulnerability
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-prgp-w7vf-ch62· CVE-2023-39659, PYSEC-2023-147LangChain vulnerable to arbitrary code execution
Modified: 9/27/2024
MEDIUM6.5PyPI
GHSA-rgp8-pm28-3759· CVE-2024-3571, PYSEC-2026-1510langchain vulnerable to path traversal
Modified: 7/7/2026
CRITICAL9.8PyPI
GHSA-x32c-59v5-h7fg· CVE-2023-34540, PYSEC-2023-91Langchain OS Command Injection vulnerability
Modified: 2/21/2025
—PyPI
PYSEC-2023-109· CVE-2023-36188, GHSA-57fc-8q82-gfp3Modified: 6/10/2026
—PyPI
PYSEC-2023-110· CVE-2023-36189, GHSA-7q94-qpjr-xpgmModified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-138· CVE-2023-36095, GHSA-gwqq-6vq7-5j86Modified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-145· CVE-2023-38860, GHSA-fj32-q626-pjjcModified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-146· CVE-2023-38896, GHSA-92j5-3459-qgp4Modified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-147· CVE-2023-39659, GHSA-prgp-w7vf-ch62Modified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-151· CVE-2023-36281, GHSA-7gfq-f96f-g85jModified: 6/10/2026
CRITICAL9.8PyPI
PYSEC-2023-162· CVE-2023-39631, GHSA-f73w-4m7g-ch9xModified: 11/8/2023
—PyPI
PYSEC-2023-18· CVE-2023-29374, GHSA-fprp-p869-w6q2Modified: 6/10/2026
—PyPI
PYSEC-2023-205· CVE-2023-46229, GHSA-655w-fm8m-m478Modified: 6/10/2026
—PyPI
PYSEC-2023-91· CVE-2023-34540, GHSA-x32c-59v5-h7fgModified: 6/10/2026
—PyPI
PYSEC-2023-92· CVE-2023-34541, GHSA-6643-h7h5-x9whModified: 6/10/2026
—PyPI
PYSEC-2023-98· CVE-2023-36258, GHSA-2qmj-7962-cjq8Modified: 6/10/2026
MEDIUM4.7PyPI
PYSEC-2024-118· CVE-2024-2965, GHSA-3hjh-jh2h-vrg6Modified: 7/13/2026
HIGH7.8PyPI
PYSEC-2024-323· CVE-2024-5998, GHSA-f2jm-rw3h-6phgModified: 7/13/2026
—PyPI
PYSEC-2024-43· CVE-2024-28088, GHSA-h59x-p739-982cModified: 3/13/2024
MEDIUM4.9PyPI
PYSEC-2026-1507· CVE-2024-8309, GHSA-45pg-36p6-83v9Langchain SQL Injection vulnerability
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1508· CVE-2023-32786, GHSA-6h8p-4hx9-w66cLangchain Server-Side Request Forgery vulnerability
Modified: 7/7/2026
LOW3.7PyPI
PYSEC-2026-1509· CVE-2024-0243, GHSA-h9j7-5xvc-qhg5langchain Server-Side Request Forgery vulnerability
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1510· CVE-2024-3571, GHSA-rgp8-pm28-3759langchain vulnerable to path traversal
Modified: 7/7/2026
MEDIUM5.5PyPI
PYSEC-2026-2192· CVE-2026-55443, GHSA-gr75-jv2w-4656Modified: 7/13/2026
HIGH7.1PyPI
PYSEC-2026-2555· CVE-2026-45134, GHSA-3644-q5cj-c5c7LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-372· CVE-2023-32785, GHSA-8h5w-f6q9-wg35Langchain SQL Injection vulnerability
Modified: 7/1/2026