# langchain-core (PyPI) vulnerabilities 9 known vulnerabilities (1 critical, 4 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.7.6 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 1.7.6 (Nov 5, 2026), the latest release - Weekly downloads: 37.2M - Dependents: 6,323 - Releases: 321 since 0.0.1 (Nov 20, 2023) - Registry: https://pypi.org/project/langchain-core/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44843: 0.0.1 to 0.3.84 (0.3.85 is outside it); 1.0.0 to 1.3.2 (1.3.3 is outside it) - CVE-2026-40087: 0.0.1 to 0.3.83 (0.3.84 is outside it); 1.0.0a1 to 1.2.27 (1.2.28 is outside it) - CVE-2026-34070: 0.0.1 to 1.2.21 (1.2.22 is outside it) - CVE-2026-26013: 0.0.1 to 1.2.10 (1.2.11 is outside it) - CVE-2025-68664: 0.0.1 to 0.3.80 (0.3.81 is outside it); 1.0.0 to 1.2.4 (1.2.5 is outside it) - CVE-2025-65106: 0.0.1 to 0.3.79 (0.3.80 is outside it); 1.0.0 to 1.0.6 (1.0.7 is outside it) - CVE-2024-10940: 0.1.17 to 0.1.52 (0.1.53 is outside it); 0.2.0 to 0.2.42 (0.2.43 is outside it); 0.3.0 to 0.3.14 (0.3.15 is outside it) - CVE-2024-1455: 0.0.1 to 0.1.34 (0.1.35 is outside it) - CVE-2024-28088: 0.0.1 to 0.1.29 (0.1.30 is outside it) ## Advisories (9) ### [CVE-2026-44843](https://cve.now/CVE-2026-44843): LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad \`load()\` allowlists - Severity: High 8.2 - Published: May 26, 2026 - Affected: from 1.0.0, fixed in 1.3.3; fixed in 0.3.85; fixed in 0.3.85; from 1.0.0, fixed in 1.3.3. - Fixed in 0.3.85 (released May 5, 2026, 21 days before disclosure) and 1.3.3 (released May 5, 2026, 21 days before disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2026-40087](https://cve.now/CVE-2026-40087): LangChain has incomplete f-string validation in prompt templates - Severity: Medium 5.3 - Published: Apr 9, 2026 - Affected: fixed in 0.3.84; from 1.0.0a1, fixed in 1.2.28; fixed in 0.3.84; from 1.0.0a1, fixed in 1.2.28. - Fixed in 0.3.84 (released Apr 8, 2026, 1 day before disclosure) and 1.2.28 (released Apr 8, 2026, 1 day before disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2026-34070](https://cve.now/CVE-2026-34070): LangChain Core has Path Traversal vulnerabilites in legacy \`load\_prompt\` functions - Severity: High 7.5 - Published: Mar 31, 2026 - Affected: fixed in 1.2.22. - Fixed in 1.2.22 (released Mar 24, 2026, 7 days before disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2026-26013](https://cve.now/CVE-2026-26013): LangChain affected by SSRF via image\_url token counting in ChatOpenAI.get\_num\_tokens\_from\_messages - Severity: Low 3.7 - Published: Feb 10, 2026 - Affected: fixed in 1.2.11. - Fixed in 1.2.11 (released Feb 10, 2026, the day of disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2025-68664](https://cve.now/CVE-2025-68664): LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs - Severity: Critical 9.3 - Published: Dec 23, 2025 - Affected: from 1.0.0, fixed in 1.2.5; fixed in 0.3.81. - Fixed in 0.3.81 (released Dec 23, 2025, the day of disclosure) and 1.2.5 (released Dec 22, 2025, 1 day before disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2025-65106](https://cve.now/CVE-2025-65106): LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates - Severity: High 8.3 - Published: Nov 21, 2025 - Affected: from 1.0.0, fixed in 1.0.7; fixed in 0.3.80; fixed in 0.3.80; from 1.0.0, fixed in 1.0.7. - Fixed in 0.3.80 (released Nov 19, 2025, 2 days before disclosure) and 1.0.7 (released Nov 19, 2025, 2 days before disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2024-10940](https://cve.now/CVE-2024-10940): Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain - Severity: Medium 5.3 - Published: Mar 20, 2025 - Affected: from 0.1.17, fixed in 0.1.53; from 0.2.0, fixed in 0.2.43; from 0.3.0, fixed in 0.3.15; from 0.1.17, fixed in 0.1.53; from 0.2.0, fixed in 0.2.43; from 0.3.0, fixed in 0.3.15. - Fixed in 0.1.53 (released Nov 2, 2024, 138 days before disclosure), 0.2.43 (released Oct 31, 2024, 140 days before disclosure) and 0.3.15 (released Oct 31, 2024, 140 days before disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2024-1455](https://cve.now/CVE-2024-1455): Billion Laughs Attack leading to DoS in langchain-ai/langchain - Severity: Medium 5.9 - Published: Mar 26, 2024 - Affected: fixed in 0.1.35. - Fixed in 0.1.35 (released Mar 27, 2024, 1 day after disclosure). - The latest release, 1.7.6, is not affected. ### [CVE-2024-28088](https://cve.now/CVE-2024-28088): LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a… - Severity: High 8.1 - Published: Mar 3, 2024 - Affected: fixed in 0.1.30; fixed in 0.1.11. - Fixed in 0.1.30 (released Mar 7, 2024, 4 days after disclosure). - The latest release, 1.7.6, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/langchain-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.