{"schema_version":1,"title":"LangChain AI vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in LangChain AI: 0 in the last 7 days and 2 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-115883, was published on 23 October 2026. 1 vulnerability in the last four weeks, level on the four before (1).","url":"https://junglewise.ai/threats/vendors/langchain-ai","json_url":"https://junglewise.ai/threats/vendors/langchain-ai.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/langchain-ai","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":2,"all_time":9,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":2,"last_365_days":8},"latest":[{"cve":"CVE-2026-115883","cvss":4,"epss":0.003,"slug":"cve-2026-115883-langgraph-checkpoint-savers-provide-postgres-and-sqlite-backed","title":"LangGraph checkpoint savers namespace validation bypass in SQLite and Postgres","severity":"medium","exploited":false,"published_at":"2026-10-23T22:16:57.82+00:00","url":"https://junglewise.ai/threats/cve-2026-115883-langgraph-checkpoint-savers-provide-postgres-and-sqlite-backed"},{"cve":"CVE-2026-106119","cvss":4,"epss":0.0046,"slug":"cve-2026-106119-langchain-is-a-framework-for-building-llm-powered-applications","title":"LangChain MongoDBChatMessageHistory query operator injection","severity":"medium","exploited":false,"published_at":"2026-10-06T19:17:42.8+00:00","url":"https://junglewise.ai/threats/cve-2026-106119-langchain-is-a-framework-for-building-llm-powered-applications"},{"cve":"CVE-2026-71433","cvss":5.3,"epss":0.0036,"slug":"cve-2026-71433-langgraph-incorrect-authorization-in-postgres-and-sqlite","title":"LangGraph incorrect authorization in Postgres and SQLite namespace matching","severity":"medium","exploited":false,"published_at":"2026-08-06T19:03:12+00:00","url":"https://junglewise.ai/threats/cve-2026-71433-langgraph-incorrect-authorization-in-postgres-and-sqlite"},{"cve":"CVE-2026-14742","cvss":3.1,"slug":"cve-2026-14742-langchain-langgraph-weak-hash-in-task-result-cache","title":"LangChain LangGraph weak hash in Task Result Cache","severity":"low","exploited":false,"published_at":"2026-07-05T11:16:27.39+00:00","url":"https://junglewise.ai/threats/cve-2026-14742-langchain-langgraph-weak-hash-in-task-result-cache"},{"cve":"CVE-2026-55443","cvss":5.1,"epss":0.0021,"slug":"cve-2026-55443-langchain-path-traversal-and-sandbox-escape-in-file-search","title":"LangChain path traversal and sandbox escape in file-search middleware and loaders","severity":"medium","exploited":false,"published_at":"2026-06-22T19:17:21.537+00:00","url":"https://junglewise.ai/threats/cve-2026-55443-langchain-path-traversal-and-sandbox-escape-in-file-search"},{"cve":"CVE-2026-48775","cvss":6.8,"epss":0.0069,"slug":"cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer","title":"LangChain LangGraph unsafe deserialization in JsonPlusSerializer","severity":"medium","exploited":false,"published_at":"2026-06-16T19:16:58.88+00:00","url":"https://junglewise.ai/threats/cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer"},{"cve":"CVE-2026-45134","cvss":7.1,"epss":0.0034,"slug":"cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull","title":"LangChain LangSmith SDK untrusted deserialization in prompt pull methods","severity":"high","exploited":false,"published_at":"2026-05-27T20:16:38.697+00:00","url":"https://junglewise.ai/threats/cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull"},{"cve":"CVE-2024-58340","cvss":7.5,"epss":0.0047,"slug":"cve-2024-58340-langchain-redos-in-mrkloutputparser","title":"LangChain ReDoS in MRKLOutputParser","severity":"high","exploited":false,"published_at":"2026-01-12T23:15:51.78+00:00","url":"https://junglewise.ai/threats/cve-2024-58340-langchain-redos-in-mrkloutputparser"},{"cve":"CVE-2023-36188","cvss":9.8,"epss":0.019,"slug":"cve-2023-36188-langchain-remote-code-execution-in-palchain-python-exec-method","title":"LangChain remote code execution in PALChain Python exec method","severity":"critical","exploited":false,"published_at":"2023-07-06T15:30:33+00:00","url":"https://junglewise.ai/threats/cve-2023-36188-langchain-remote-code-execution-in-palchain-python-exec-method"}],"vendor":{"hub":true,"name":"LangChain AI","slug":"langchain-ai","description":"Company that develops LangChain, a framework for building applications with large language models.","url":"https://junglewise.ai/threats/vendors/langchain-ai"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2023-36188","cvss":9.8,"epss":0.019,"slug":"cve-2023-36188-langchain-remote-code-execution-in-palchain-python-exec-method","title":"LangChain remote code execution in PALChain Python exec method","severity":"critical","exploited":false,"published_at":"2023-07-06T15:30:33+00:00","url":"https://junglewise.ai/threats/cve-2023-36188-langchain-remote-code-execution-in-palchain-python-exec-method"},{"cve":"CVE-2024-58340","cvss":7.5,"epss":0.0047,"slug":"cve-2024-58340-langchain-redos-in-mrkloutputparser","title":"LangChain ReDoS in MRKLOutputParser","severity":"high","exploited":false,"published_at":"2026-01-12T23:15:51.78+00:00","url":"https://junglewise.ai/threats/cve-2024-58340-langchain-redos-in-mrkloutputparser"},{"cve":"CVE-2026-45134","cvss":7.1,"epss":0.0034,"slug":"cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull","title":"LangChain LangSmith SDK untrusted deserialization in prompt pull methods","severity":"high","exploited":false,"published_at":"2026-05-27T20:16:38.697+00:00","url":"https://junglewise.ai/threats/cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull"},{"cve":"CVE-2026-48775","cvss":6.8,"epss":0.0069,"slug":"cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer","title":"LangChain LangGraph unsafe deserialization in JsonPlusSerializer","severity":"medium","exploited":false,"published_at":"2026-06-16T19:16:58.88+00:00","url":"https://junglewise.ai/threats/cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer"},{"cve":"CVE-2026-71433","cvss":5.3,"epss":0.0036,"slug":"cve-2026-71433-langgraph-incorrect-authorization-in-postgres-and-sqlite","title":"LangGraph incorrect authorization in Postgres and SQLite namespace matching","severity":"medium","exploited":false,"published_at":"2026-08-06T19:03:12+00:00","url":"https://junglewise.ai/threats/cve-2026-71433-langgraph-incorrect-authorization-in-postgres-and-sqlite"},{"cve":"CVE-2026-55443","cvss":5.1,"epss":0.0021,"slug":"cve-2026-55443-langchain-path-traversal-and-sandbox-escape-in-file-search","title":"LangChain path traversal and sandbox escape in file-search middleware and loaders","severity":"medium","exploited":false,"published_at":"2026-06-22T19:17:21.537+00:00","url":"https://junglewise.ai/threats/cve-2026-55443-langchain-path-traversal-and-sandbox-escape-in-file-search"},{"cve":"CVE-2026-106119","cvss":4,"epss":0.0046,"slug":"cve-2026-106119-langchain-is-a-framework-for-building-llm-powered-applications","title":"LangChain MongoDBChatMessageHistory query operator injection","severity":"medium","exploited":false,"published_at":"2026-10-06T19:17:42.8+00:00","url":"https://junglewise.ai/threats/cve-2026-106119-langchain-is-a-framework-for-building-llm-powered-applications"},{"cve":"CVE-2026-115883","cvss":4,"epss":0.003,"slug":"cve-2026-115883-langgraph-checkpoint-savers-provide-postgres-and-sqlite-backed","title":"LangGraph checkpoint savers namespace validation bypass in SQLite and Postgres","severity":"medium","exploited":false,"published_at":"2026-10-23T22:16:57.82+00:00","url":"https://junglewise.ai/threats/cve-2026-115883-langgraph-checkpoint-savers-provide-postgres-and-sqlite-backed"},{"cve":"CVE-2026-14742","cvss":3.1,"slug":"cve-2026-14742-langchain-langgraph-weak-hash-in-task-result-cache","title":"LangChain LangGraph weak hash in Task Result Cache","severity":"low","exploited":false,"published_at":"2026-07-05T11:16:27.39+00:00","url":"https://junglewise.ai/threats/cve-2026-14742-langchain-langgraph-weak-hash-in-task-result-cache"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[]}