{"schema_version":1,"title":"LangChain vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 10 vulnerabilities in LangChain: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-55253, was published on 14 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/langchain","json_url":"https://junglewise.ai/threats/vendors/langchain.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/langchain","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":2,"all_time":10,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":4,"last_365_days":10},"latest":[{"cve":"CVE-2026-55253","cvss":7.7,"epss":0.0053,"slug":"cve-2026-55253-langchain-mongodb-nosql-injection-in-list-search-methods","title":"LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and la","severity":"high","exploited":false,"published_at":"2026-09-14T18:17:55.5+00:00","url":"https://junglewise.ai/threats/cve-2026-55253-langchain-mongodb-nosql-injection-in-list-search-methods"},{"cve":"CVE-2026-48121","cvss":6.7,"epss":0.0036,"slug":"cve-2026-48121-langchain-langgraph-nosql-injection-in-mongodbsaver","title":"@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0","severity":"medium","exploited":false,"published_at":"2026-08-04T17:16:55.267+00:00","url":"https://junglewise.ai/threats/cve-2026-48121-langchain-langgraph-nosql-injection-in-mongodbsaver"},{"cve":"CVE-2026-25528","cvss":3.1,"epss":0.0033,"slug":"cve-2026-25528-langchain-langsmith-sdk-server-side-request-forgery-via-tracing","title":"PYSEC-2026-2584 - LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:35.362216+00:00","url":"https://junglewise.ai/threats/cve-2026-25528-langchain-langsmith-sdk-server-side-request-forgery-via-tracing"},{"cve":"CVE-2026-59152","cvss":5,"epss":0.002,"slug":"cve-2026-59152-langchain-langsmith-sdk-arbitrary-file-read-in-tracingmiddleware","title":"LangChain LangSmith SDK arbitrary file read in TracingMiddleware","severity":"medium","exploited":false,"published_at":"2026-07-06T16:16:37.413+00:00","url":"https://junglewise.ai/threats/cve-2026-59152-langchain-langsmith-sdk-arbitrary-file-read-in-tracingmiddleware"},{"cve":"CVE-2026-48776","cvss":4.2,"epss":0.0029,"slug":"cve-2026-48776-langchain-langgraph-sdk-path-traversal-in-url-construction","title":"LangChain LangGraph SDK path traversal in URL construction","severity":"medium","exploited":false,"published_at":"2026-06-17T10:55:15.113+00:00","url":"https://junglewise.ai/threats/cve-2026-48776-langchain-langgraph-sdk-path-traversal-in-url-construction"},{"cve":"CVE-2026-48775","cvss":6.8,"epss":0.0069,"slug":"cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer","title":"LangChain LangGraph unsafe deserialization in JsonPlusSerializer","severity":"medium","exploited":false,"published_at":"2026-06-16T19:16:58.88+00:00","url":"https://junglewise.ai/threats/cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer"},{"cve":"CVE-2026-45134","cvss":7.1,"epss":0.0034,"slug":"cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull","title":"LangChain LangSmith SDK untrusted deserialization in prompt pull methods","severity":"high","exploited":false,"published_at":"2026-05-27T20:16:38.697+00:00","url":"https://junglewise.ai/threats/cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull"},{"cve":"CVE-2026-41481","cvss":6.5,"epss":0.0044,"slug":"cve-2026-41481-langchain-langchain-text-splitters-ssrf-redirect-bypass-in","title":"LangChain langchain-text-splitters SSRF redirect bypass in HTMLHeaderTextSplitter","severity":"medium","exploited":false,"published_at":"2026-04-24T21:16:19.49+00:00","url":"https://junglewise.ai/threats/cve-2026-41481-langchain-langchain-text-splitters-ssrf-redirect-bypass-in"},{"cve":"CVE-2026-41182","cvss":5.3,"epss":0.0036,"slug":"cve-2026-41182-langchain-langsmith-sdk-sensitive-information-leak-in-streaming","title":"LangChain LangSmith SDK sensitive information leak in streaming events","severity":"medium","exploited":false,"published_at":"2026-04-23T02:16:16.123+00:00","url":"https://junglewise.ai/threats/cve-2026-41182-langchain-langsmith-sdk-sensitive-information-leak-in-streaming"},{"cve":"CVE-2026-27022","cvss":3.1,"epss":0.0049,"slug":"cve-2026-27022-langchain-redisearch-query-injection-in-langgraph-checkpoint","title":"LangChain RediSearch query injection in langgraph-checkpoint-redis","severity":"low","exploited":false,"published_at":"2026-02-18T22:40:09+00:00","url":"https://junglewise.ai/threats/cve-2026-27022-langchain-redisearch-query-injection-in-langgraph-checkpoint"}],"vendor":{"hub":true,"name":"LangChain","slug":"langchain","description":"Framework for developing applications with large language models through composable chains and agents.","url":"https://junglewise.ai/threats/vendors/langchain"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-55253","cvss":7.7,"epss":0.0053,"slug":"cve-2026-55253-langchain-mongodb-nosql-injection-in-list-search-methods","title":"LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and la","severity":"high","exploited":false,"published_at":"2026-09-14T18:17:55.5+00:00","url":"https://junglewise.ai/threats/cve-2026-55253-langchain-mongodb-nosql-injection-in-list-search-methods"},{"cve":"CVE-2026-45134","cvss":7.1,"epss":0.0034,"slug":"cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull","title":"LangChain LangSmith SDK untrusted deserialization in prompt pull methods","severity":"high","exploited":false,"published_at":"2026-05-27T20:16:38.697+00:00","url":"https://junglewise.ai/threats/cve-2026-45134-langchain-langsmith-sdk-untrusted-deserialization-in-prompt-pull"},{"cve":"CVE-2026-48775","cvss":6.8,"epss":0.0069,"slug":"cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer","title":"LangChain LangGraph unsafe deserialization in JsonPlusSerializer","severity":"medium","exploited":false,"published_at":"2026-06-16T19:16:58.88+00:00","url":"https://junglewise.ai/threats/cve-2026-48775-langchain-langgraph-unsafe-deserialization-in-jsonplusserializer"},{"cve":"CVE-2026-48121","cvss":6.7,"epss":0.0036,"slug":"cve-2026-48121-langchain-langgraph-nosql-injection-in-mongodbsaver","title":"@langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0","severity":"medium","exploited":false,"published_at":"2026-08-04T17:16:55.267+00:00","url":"https://junglewise.ai/threats/cve-2026-48121-langchain-langgraph-nosql-injection-in-mongodbsaver"},{"cve":"CVE-2026-41481","cvss":6.5,"epss":0.0044,"slug":"cve-2026-41481-langchain-langchain-text-splitters-ssrf-redirect-bypass-in","title":"LangChain langchain-text-splitters SSRF redirect bypass in HTMLHeaderTextSplitter","severity":"medium","exploited":false,"published_at":"2026-04-24T21:16:19.49+00:00","url":"https://junglewise.ai/threats/cve-2026-41481-langchain-langchain-text-splitters-ssrf-redirect-bypass-in"},{"cve":"CVE-2026-41182","cvss":5.3,"epss":0.0036,"slug":"cve-2026-41182-langchain-langsmith-sdk-sensitive-information-leak-in-streaming","title":"LangChain LangSmith SDK sensitive information leak in streaming events","severity":"medium","exploited":false,"published_at":"2026-04-23T02:16:16.123+00:00","url":"https://junglewise.ai/threats/cve-2026-41182-langchain-langsmith-sdk-sensitive-information-leak-in-streaming"},{"cve":"CVE-2026-59152","cvss":5,"epss":0.002,"slug":"cve-2026-59152-langchain-langsmith-sdk-arbitrary-file-read-in-tracingmiddleware","title":"LangChain LangSmith SDK arbitrary file read in TracingMiddleware","severity":"medium","exploited":false,"published_at":"2026-07-06T16:16:37.413+00:00","url":"https://junglewise.ai/threats/cve-2026-59152-langchain-langsmith-sdk-arbitrary-file-read-in-tracingmiddleware"},{"cve":"CVE-2026-48776","cvss":4.2,"epss":0.0029,"slug":"cve-2026-48776-langchain-langgraph-sdk-path-traversal-in-url-construction","title":"LangChain LangGraph SDK path traversal in URL construction","severity":"medium","exploited":false,"published_at":"2026-06-17T10:55:15.113+00:00","url":"https://junglewise.ai/threats/cve-2026-48776-langchain-langgraph-sdk-path-traversal-in-url-construction"},{"cve":"CVE-2026-27022","cvss":3.1,"epss":0.0049,"slug":"cve-2026-27022-langchain-redisearch-query-injection-in-langgraph-checkpoint","title":"LangChain RediSearch query injection in langgraph-checkpoint-redis","severity":"low","exploited":false,"published_at":"2026-02-18T22:40:09+00:00","url":"https://junglewise.ai/threats/cve-2026-27022-langchain-redisearch-query-injection-in-langgraph-checkpoint"},{"cve":"CVE-2026-25528","cvss":3.1,"epss":0.0033,"slug":"cve-2026-25528-langchain-langsmith-sdk-server-side-request-forgery-via-tracing","title":"PYSEC-2026-2584 - LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:35.362216+00:00","url":"https://junglewise.ai/threats/cve-2026-25528-langchain-langsmith-sdk-server-side-request-forgery-via-tracing"}],"generated_at":"2026-09-26T13:07:00.120236+00:00","technologies":[{"name":"LangChain LangSmith SDK","slug":"langsmith-sdk","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/langsmith-sdk"}]}