Technology · PyPI
langchain (PyPI) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 26 vulnerabilities in langchain (PyPI): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2024-2965, was published on 13 July 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 2
- Exploited in the wild
- 0
About langchain (PyPI)
Python framework for building applications with language models through composable chains and agents.
Latest langchain (PyPI) vulnerabilities
- CVE-2024-2965: PYSEC-2026-2561 - Denial of service in langchain-communitylowCVSS 3.1EPSS 0.3%
- CVE-2024-8309: PYSEC-2026-1507 - Langchain SQL Injection vulnerabilitylowCVSS 3.1EPSS 13.7%
- CVE-2024-5998: PYSEC-2026-1514 - LangChain pickle deserialization of untrusted datalowCVSS 3.1EPSS 0.4%
- CVE-2024-3571: PYSEC-2026-1510 - langchain vulnerable to path traversallowCVSS 3EPSS 1.9%
- CVE-2024-0243: PYSEC-2026-1509 - langchain Server-Side Request Forgery vulnerabilitylowCVSS 3.1EPSS 0.5%
- CVE-2023-32786: PYSEC-2026-1508 - Langchain Server-Side Request Forgery vulnerabilitylowCVSS 3.1EPSS 0.7%
- CVE-2026-55443: LangChain path traversal and sandbox escape in file-search middleware and loadersmediumCVSS 5.1EPSS 0.2%
- CVE-2026-45134: LangChain LangSmith SDK untrusted deserialization in prompt pull methodshighCVSS 7.1EPSS 0.3%
- CVE-2024-58340: LangChain ReDoS in MRKLOutputParserhighCVSS 7.5EPSS 0.5%
- PYSEC-2024-111 - A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version…lowCVSS 3.1
- PYSEC-2024-114 - A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all…lowCVSS 3.1
- CVE-2024-28088: LangChain directory traversal vulnerabilityinfoEPSS 1.7%
- CVE-2023-32785: Langchain SQL Injection vulnerabilitycriticalCVSS 9.8
- CVE-2023-46229: LangChain Server Side Request Forgery vulnerabilitylowCVSS 3.1EPSS 44.7%
- CVE-2023-39631: Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr librarylowCVSS 3.1EPSS 1.6%
- CVE-2023-36281: PYSEC-2023-151 - An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json…lowCVSS 3.1EPSS 3.4%
- CVE-2023-39659: LangChain vulnerable to arbitrary code executionlowCVSS 3.1EPSS 1.5%
- CVE-2023-38860: PYSEC-2023-145 - An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt…lowCVSS 3.1EPSS 1.4%
- CVE-2023-38896: LangChain vulnerable to arbitrary code executionlowCVSS 3.1EPSS 1.8%
- CVE-2023-36095: langchain Code Injection vulnerabilitylowCVSS 3.1EPSS 1.2%
- CVE-2023-36188: LangChain remote code execution in PALChain Python exec methodcriticalCVSS 9.8EPSS 1.9%
- CVE-2023-36189: langchain SQL Injection vulnerabilitylowCVSS 3.1EPSS 1.3%
- CVE-2023-36258: PYSEC-2023-98 - An issue in langchain v.0.0.199 allows an attacker to execute arbitrary code via the PALChain in the…lowCVSS 3.1EPSS 1.1%
- CVE-2023-34541: PYSEC-2023-92 - Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.lowCVSS 3.1EPSS 0.9%
- CVE-2023-34540: PYSEC-2023-91 - Langchain 0.0.171 is vulnerable to Arbitrary Code Execution.lowCVSS 3.1EPSS 1.7%
Most severe langchain (PyPI) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-36188: LangChain remote code execution in PALChain Python exec methodcriticalCVSS 9.8EPSS 1.9%
- CVE-2023-32785: Langchain SQL Injection vulnerabilitycriticalCVSS 9.8
- CVE-2024-58340: LangChain ReDoS in MRKLOutputParserhighCVSS 7.5EPSS 0.5%
- CVE-2026-45134: LangChain LangSmith SDK untrusted deserialization in prompt pull methodshighCVSS 7.1EPSS 0.3%
- CVE-2026-55443: LangChain path traversal and sandbox escape in file-search middleware and loadersmediumCVSS 5.1EPSS 0.2%
- CVE-2023-46229: LangChain Server Side Request Forgery vulnerabilitylowCVSS 3.1EPSS 44.7%
- CVE-2023-29374: LangChain vulnerable to code injectionlowCVSS 3.1EPSS 39.6%
- CVE-2024-8309: PYSEC-2026-1507 - Langchain SQL Injection vulnerabilitylowCVSS 3.1EPSS 13.7%
- CVE-2023-36281: PYSEC-2023-151 - An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json…lowCVSS 3.1EPSS 3.4%
- CVE-2023-38896: LangChain vulnerable to arbitrary code executionlowCVSS 3.1EPSS 1.8%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many langchain (PyPI) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/langchain)<a href="https://junglewise.ai/threats/technologies/langchain"><img src="https://junglewise.ai/threats/technologies/langchain/badge.svg" alt="langchain (PyPI) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/langchain.json, and this page as text at https://junglewise.ai/threats/technologies/langchain.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "langchain (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/langchain, 13 November 2026.