pypi

langchain-core

18 Total advisories

18 Vulnerabilities

0 Malware

Dependency scanning

Check whether langchain-core is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

langchain-core

Vulnerabilities

LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

LangChain has incomplete f-string validation in prompt templates

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

LangChain has incomplete f-string validation in prompt templates

LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

CVE-2026-34070

LangChain's XMLOutputParser vulnerable to XML Entity Expansion

langchain-core allows unauthorized users to read arbitrary files from the host file system

langchain-core allows unauthorized users to read arbitrary files from the host file system

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

LangChain's XMLOutputParser vulnerable to XML Entity Expansion

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

CVE-2024-28088

LangChain directory traversal vulnerability

Browse more PyPI advisories

Start Securing