[ Vendor · 3 CVEs ]
langchain-ai
CVEs affecting langchain-ai published in the last 30 days, plus any langchain-ai CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106119 | 6 Oct 2026 | CVSS 6.0 | LangChain: MongoDBChatMessageHistory query injection can allow cross-session accessLangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type… | Fix |
| CVE-2026-105799 | 6 Oct 2026 | CVSS 2.3 | LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesLangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in… | Fix |
| CVE-2026-104873 | 2 Oct 2026 | CVSS 7.6 | LangGraph SDK custom auth silently ignores actions= on resource decoratorsLangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From… | Fix |