Vulnerabilities for langchain-core

First version without a known vulnerability: 1.4.0a1

Details

• GHSA-pjwx-r37v-77242026-05-08

  LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

  Fixed in: 1.3.3, 0.3.85

• GHSA-926x-3r5x-gfhw2026-04-08

  LangChain has incomplete f-string validation in prompt templates

  Fixed in: 0.3.84, 1.2.28

• GHSA-qh6h-p6c9-ff542026-03-27

  LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

  Fixed in: 1.2.22

• GHSA-2g6r-c272-w58r2026-02-11

  LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

  Fixed in: 1.2.11

• GHSA-c67j-w6g6-q2cm2025-12-23

  LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

  Fixed in: 1.2.5, 0.3.81

• GHSA-6qv9-48xg-fc7f2025-11-20

  LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

  Fixed in: 1.0.7, 0.3.80

• GHSA-5chr-fjjv-38qv2025-03-20

  langchain-core allows unauthorized users to read arbitrary files from the host file system

  Fixed in: 0.1.53, 0.2.43, 0.3.15

• GHSA-q84m-rmw3-43822024-03-26

  LangChain's XMLOutputParser vulnerable to XML Entity Expansion

  Fixed in: 0.1.35

• GHSA-h59x-p739-982c2024-03-04

  LangChain directory traversal vulnerability

  Fixed in: 0.0.339, 0.1.30, 0.1.11