Vendor
LangChain AI vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 9 vulnerabilities in LangChain AI: 0 in the last 7 days and 2 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115883, was published on 23 October 2026. 1 vulnerability in the last four weeks, level on the four before (1).
- Last 7 days
- 0
- Last 90 days
- 2
- Critical, all time
- 1
- Exploited in the wild
- 0
About LangChain AI
Company that develops LangChain, a framework for building applications with large language models.
Latest LangChain AI vulnerabilities
- CVE-2026-115883: LangGraph checkpoint savers namespace validation bypass in SQLite and PostgresmediumCVSS 4EPSS 0.3%
- CVE-2026-106119: LangChain MongoDBChatMessageHistory query operator injectionmediumCVSS 4EPSS 0.5%
- CVE-2026-71433: LangGraph incorrect authorization in Postgres and SQLite namespace matchingmediumCVSS 5.3EPSS 0.4%
- CVE-2026-14742: LangChain LangGraph weak hash in Task Result CachelowCVSS 3.1
- CVE-2026-55443: LangChain path traversal and sandbox escape in file-search middleware and loadersmediumCVSS 5.1EPSS 0.2%
- CVE-2026-48775: LangChain LangGraph unsafe deserialization in JsonPlusSerializermediumCVSS 6.8EPSS 0.7%
- CVE-2026-45134: LangChain LangSmith SDK untrusted deserialization in prompt pull methodshighCVSS 7.1EPSS 0.3%
- CVE-2024-58340: LangChain ReDoS in MRKLOutputParserhighCVSS 7.5EPSS 0.5%
- CVE-2023-36188: LangChain remote code execution in PALChain Python exec methodcriticalCVSS 9.8EPSS 1.9%
Most severe LangChain AI vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-36188: LangChain remote code execution in PALChain Python exec methodcriticalCVSS 9.8EPSS 1.9%
- CVE-2024-58340: LangChain ReDoS in MRKLOutputParserhighCVSS 7.5EPSS 0.5%
- CVE-2026-45134: LangChain LangSmith SDK untrusted deserialization in prompt pull methodshighCVSS 7.1EPSS 0.3%
- CVE-2026-48775: LangChain LangGraph unsafe deserialization in JsonPlusSerializermediumCVSS 6.8EPSS 0.7%
- CVE-2026-71433: LangGraph incorrect authorization in Postgres and SQLite namespace matchingmediumCVSS 5.3EPSS 0.4%
- CVE-2026-55443: LangChain path traversal and sandbox escape in file-search middleware and loadersmediumCVSS 5.1EPSS 0.2%
- CVE-2026-106119: LangChain MongoDBChatMessageHistory query operator injectionmediumCVSS 4EPSS 0.5%
- CVE-2026-115883: LangGraph checkpoint savers namespace validation bypass in SQLite and PostgresmediumCVSS 4EPSS 0.3%
- CVE-2026-14742: LangChain LangGraph weak hash in Task Result CachelowCVSS 3.1
Vulnerabilities per week
1 vulnerability in the last four weeks, level on the four before (1). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many LangChain AI vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/langchain-ai)<a href="https://junglewise.ai/threats/vendors/langchain-ai"><img src="https://junglewise.ai/threats/vendors/langchain-ai/badge.svg" alt="LangChain AI vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/langchain-ai.json, and this page as text at https://junglewise.ai/threats/vendors/langchain-ai.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "LangChain AI vulnerabilities", https://junglewise.ai/threats/vendors/langchain-ai, 9 November 2026.