Langchain Ai
Monthly
Cross-user Store access in LangGraph API (pip package langgraph-api) versions 0.1.2 through 0.14.x lets an ordinary authenticated user read, overwrite, search or delete Store data belonging to another user. The flaw only manifests in deployments running JavaScript or TypeScript custom authentication whose Store authorization handler restricts users by rewriting the requested namespace: the rewritten namespace is not carried across the runtime boundary and applied before the Store operation, so the original (attacker-supplied) namespace is used instead (CWE-639). Python custom authentication and JS/TS handlers that reject unauthorized namespaces rather than rewriting them are unaffected; vendor CVSS 4.0 scores it 8.6 High and the issue is fixed in 0.15.0, with no public exploit identified at time of analysis.
Incorrect authorization in the LangGraph Python SDK (langgraph-sdk) versions 0.1.45 through 0.4.3 lets an authenticated user read, update, or delete resources belonging to other users, because the resource-scoped decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore their actions= argument and register the handler as a wildcard for every action on that resource. That wildcard handler is matched ahead of broader fallback handlers, so any action, ownership, or permission checks implemented in those fallbacks are silently skipped. The flaw is conditionally scoped: a deployment is only exposed if it uses these decorators together with actions= and relies on separate fallback handlers for enforcement, and authentication requirements are confirmed as authenticated (CVSS PR:L) with no public exploit identified at time of analysis. This is fixed in langgraph-sdk 0.4.4.
Path manipulation in the LangGraph Python SDK (langgraph-sdk) version 0.3.14 and earlier lets caller-supplied identifier values containing URL-special characters redirect an HTTP request to a different resource — or resource type — than the SDK call intended. When applications forward untrusted, unvalidated identifiers into SDK methods and rely on upstream URL-prefix authorization, an attacker can reach, modify, or delete resources outside their authorization scope. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but CVSS is rated 9.1 due to high confidentiality and integrity impact.
Prototype pollution in the LangSmith JavaScript/TypeScript SDK (npm 'langsmith', versions <= 0.5.17) lets an attacker who controls object keys passed to the createAnonymizer() API pollute Object.prototype for the entire Node.js process. The internally vendored lodash set() utility guards only the __proto__ key and misses the constructor.prototype traversal path, so a crafted key like 'constructor.prototype.polluted' bypasses the fix. Publicly available exploit code exists (SSVC 'poc' plus regression tests in the fix PR), but EPSS is only 0.04% with no evidence of active exploitation; notably the vendor GHSA rates this Medium (~CVSS 5.6), conflicting sharply with the NVD 9.8.
Path traversal in the LangGraph Python SDK (langgraph-sdk 0.4.0 through 0.4.5, and langgraph 1.2.3 through 1.2.13 via RemoteGraph v3 streaming) lets an attacker who controls a streaming thread_id or assistant_id value redirect the SDK's authenticated GET requests to a different readable path on the same configured LangGraph server, with thread_id also able to inject query parameters such as /store/items?namespace=...&key=... . Exploitation requires the application to pass attacker-controlled text directly as those identifiers; requests are GET-only, so the impact is limited to disclosure of another readable path's response (CVSS 4.3, PR:L - authenticated), and the hosted LangGraph Platform is not exposed. The vendor has released fixed versions langgraph-sdk 0.4.6 and langgraph 1.2.14, and no public exploit code was identified at time of analysis.
LangGraph CLI versions 0.4.15 through 0.4.31 disclose the short-lived LangSmith registry push token in verbose output: `langgraph deploy --verbose` builds the image locally, then runs `docker login --password-stdin` with the token on stdin, and the CLI's subprocess helper echoes command input when verbose is enabled. Anyone able to read the retained output before the token's maximum 12-hour lifetime expires can pull the deployment's images or push new images into that deployment's image repository, though the token alone cannot update a deployment to run a pushed image (that requires a LangSmith API key with access to the deployment). Deployments run without `--verbose` and remote image builds never print the token; no public exploit code was identified at time of analysis, and exploitation requires a specific chain of local Docker use, retained verbose logs, and retrieval within the token window.
Cross-namespace data exposure in the Postgres- and SQLite-backed LangGraph stores (langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2) lets an authenticated, low-privileged caller who can influence a namespace label read, overwrite, or delete items stored under a different tenant's namespace. The stores flatten a namespace with ".".join(namespace), so a single label such as ("tenant.bob",) resolves to the same stored text as ("tenant", "bob"); only put/aput validated labels, while get, search, delete, list_namespaces, their async variants, and ops passed straight to batch/abatch accepted dotted labels unchecked. Exposure is deployment-dependent rather than universal: it requires an application that relies on namespace tuples to isolate tenants and passes untrusted input into those calls, InMemoryStore is unaffected because it compares namespace tuples, and there is no public exploit identified at time of analysis. The reported CVSS 4.0 score is 6.0, while the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
NoSQL injection in the @langchain/mongodb provider (part of langchainjs) before version 1.3.1 lets an authenticated low-privilege user read, modify, or delete another user's stored conversation history when multiple users' chat histories live in a shared MongoDB collection and the application passes an untrusted, attacker-controllable structured sessionId into MongoDBChatMessageHistory. The root cause is that the documented string type for sessionId is only enforced by TypeScript at compile time and is erased at runtime, so a value such as {$regex: "^victim-"} is handed straight into the MongoDB query filter and interpreted as a query operator rather than a literal identifier. Impact is tightly gated: applications that derive sessionId from an authenticated, server-controlled string (the documented correct usage) or that isolate histories per user are not affected, and no public exploit code was identified at time of analysis, with no confirmed active exploitation (CISA KEV).
RediSearch query injection in @langchain/redis (the Redis vector store provider for LangChain.js) prior to version 1.1.1 lets a low-privileged attacker who can influence the values passed into structured RediSearch TAG or TEXT filters inject unescaped RediSearch syntax and thereby broaden or otherwise alter the generated search query. Where an application uses such a filter as a tenant or document-access boundary, the manipulated query can return indexed documents outside the attacker's intended scope, resulting in limited confidentiality impact (read/exposure only, no write, code execution, or availability effect). Exploitation is highly conditional: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.0 base 2.3), no public exploit code has been identified, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided, so overall risk is low; the fix is available in @langchain/redis 1.1.1.
Path traversal in LangSmith Client SDK's TracingMiddleware (versions prior to 0.8.18) enables a trust-boundary crossing where any party with LangSmith workspace trace-read access can exfiltrate arbitrary files from servers running the middleware. An attacker sends a crafted HTTP request to a TracingMiddleware-instrumented server, causing it to read a local filesystem path and upload the contents to LangSmith as a trace attachment, which the attacker then retrieves via their workspace access. No public exploit has been identified at time of analysis, but the low complexity and broadly scoped file read make this a meaningful risk for any multi-tenant or contractor-accessible LangSmith deployment.
Weak hashing in LangGraph's Task Result Cache exposes low-privilege authenticated users to hash collision attacks that can leak cached task results across isolation boundaries. All LangGraph versions through 1.2.4 are affected via the `_freeze` function in `libs/langgraph/langgraph/_internal/_cache.py`. A public proof-of-concept is disclosed at GitHub issue #8009, though the CVSS 4.0 score of 2.3 and AC:H rating reflect genuinely high exploitation difficulty; this is not listed in CISA KEV and no active exploitation has been reported.
Path traversal and sandbox escape in LangChain prior to 1.3.9 allow untrusted inputs - including LLM-generated content steered by adversarial prompts - to escape a configured filesystem root boundary. Three components are affected: a file-search agent middleware that validates a starting directory but not glob patterns or symlink targets; prompt and chain/agent configuration loaders that resolve path fields without root confinement; and path-prefix authorization logic that performs string-prefix comparison without segment boundaries, allowing sibling paths to bypass access controls. No public exploit code has been identified at time of analysis and this CVE does not appear in CISA KEV, but the risk is meaningful for any deployment that exposes LangChain filesystem agents to untrusted user input or LLM prompt injection.
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary Python object reconstruction from checkpoint payloads stored in a SQLite backing store, enabling code execution at checkpoint load time. Affected deployments are those where an unauthorized party can modify checkpoint bytes at rest - a high-privilege prerequisite (PR:H, AV:A per CVSS) that already implies a significant prior compromise. This is explicitly framed as a defense-in-depth concern: the issue escalates an existing 'checkpoint-store write access' incident into full application runtime code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.
DNS rebinding in langchain-openai before 1.1.14 allows an attacker-controlled hostname to bypass SSRF protection in the image token-counting code path, enabling blind probing of internal network services. The `_url_to_size()` helper performs URL validation and the subsequent HTTP fetch as two independent operations with separate DNS resolution, creating a TOCTOU race window that a malicious domain with a short TTL can exploit to redirect the fetch to a private or localhost address after passing the initial check. Practical impact is bounded: the HTTP response is consumed only by Pillow for image dimension extraction and is never returned or logged, making data exfiltration impossible; SSVC confirms no active exploitation, EPSS sits at the 8th percentile, and no public exploit code exists at time of analysis.
SSRF redirect bypass in langchain-text-splitters prior to 1.1.2 allows attackers who can supply URLs to applications using HTMLHeaderTextSplitter.split_text_from_url() to reach internal network endpoints, localhost services, or cloud instance metadata APIs by exploiting unvalidated HTTP redirects. The function's built-in validate_safe_url() check is circumvented because requests.get() follows 302 redirects by default without revalidating the redirect target - turning a deliberate safety feature into a false guarantee. Data exfiltration is contingent on the application returning or surfacing Document object contents to the URL-supplying party; no public exploit has been identified at time of analysis, and EPSS sits at the 9th percentile.
LangSmith Client SDKs in JavaScript (prior to 0.5.19) and Python (prior to 0.7.31) fail to apply output redaction controls to streaming token events, allowing sensitive LLM-generated content to leak into LangSmith platform storage despite hideOutputs/hide_outputs being enabled. Unauthenticated remote attackers can intercept or access unredacted streamed tokens if they gain visibility into run events, bypassing the intended confidentiality controls.
Cross-user Store access in LangGraph API (pip package langgraph-api) versions 0.1.2 through 0.14.x lets an ordinary authenticated user read, overwrite, search or delete Store data belonging to another user. The flaw only manifests in deployments running JavaScript or TypeScript custom authentication whose Store authorization handler restricts users by rewriting the requested namespace: the rewritten namespace is not carried across the runtime boundary and applied before the Store operation, so the original (attacker-supplied) namespace is used instead (CWE-639). Python custom authentication and JS/TS handlers that reject unauthorized namespaces rather than rewriting them are unaffected; vendor CVSS 4.0 scores it 8.6 High and the issue is fixed in 0.15.0, with no public exploit identified at time of analysis.
Incorrect authorization in the LangGraph Python SDK (langgraph-sdk) versions 0.1.45 through 0.4.3 lets an authenticated user read, update, or delete resources belonging to other users, because the resource-scoped decorators @auth.on.threads, @auth.on.assistants, and @auth.on.crons ignore their actions= argument and register the handler as a wildcard for every action on that resource. That wildcard handler is matched ahead of broader fallback handlers, so any action, ownership, or permission checks implemented in those fallbacks are silently skipped. The flaw is conditionally scoped: a deployment is only exposed if it uses these decorators together with actions= and relies on separate fallback handlers for enforcement, and authentication requirements are confirmed as authenticated (CVSS PR:L) with no public exploit identified at time of analysis. This is fixed in langgraph-sdk 0.4.4.
Path manipulation in the LangGraph Python SDK (langgraph-sdk) version 0.3.14 and earlier lets caller-supplied identifier values containing URL-special characters redirect an HTTP request to a different resource — or resource type — than the SDK call intended. When applications forward untrusted, unvalidated identifiers into SDK methods and rely on upstream URL-prefix authorization, an attacker can reach, modify, or delete resources outside their authorization scope. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but CVSS is rated 9.1 due to high confidentiality and integrity impact.
Prototype pollution in the LangSmith JavaScript/TypeScript SDK (npm 'langsmith', versions <= 0.5.17) lets an attacker who controls object keys passed to the createAnonymizer() API pollute Object.prototype for the entire Node.js process. The internally vendored lodash set() utility guards only the __proto__ key and misses the constructor.prototype traversal path, so a crafted key like 'constructor.prototype.polluted' bypasses the fix. Publicly available exploit code exists (SSVC 'poc' plus regression tests in the fix PR), but EPSS is only 0.04% with no evidence of active exploitation; notably the vendor GHSA rates this Medium (~CVSS 5.6), conflicting sharply with the NVD 9.8.
Path traversal in the LangGraph Python SDK (langgraph-sdk 0.4.0 through 0.4.5, and langgraph 1.2.3 through 1.2.13 via RemoteGraph v3 streaming) lets an attacker who controls a streaming thread_id or assistant_id value redirect the SDK's authenticated GET requests to a different readable path on the same configured LangGraph server, with thread_id also able to inject query parameters such as /store/items?namespace=...&key=... . Exploitation requires the application to pass attacker-controlled text directly as those identifiers; requests are GET-only, so the impact is limited to disclosure of another readable path's response (CVSS 4.3, PR:L - authenticated), and the hosted LangGraph Platform is not exposed. The vendor has released fixed versions langgraph-sdk 0.4.6 and langgraph 1.2.14, and no public exploit code was identified at time of analysis.
LangGraph CLI versions 0.4.15 through 0.4.31 disclose the short-lived LangSmith registry push token in verbose output: `langgraph deploy --verbose` builds the image locally, then runs `docker login --password-stdin` with the token on stdin, and the CLI's subprocess helper echoes command input when verbose is enabled. Anyone able to read the retained output before the token's maximum 12-hour lifetime expires can pull the deployment's images or push new images into that deployment's image repository, though the token alone cannot update a deployment to run a pushed image (that requires a LangSmith API key with access to the deployment). Deployments run without `--verbose` and remote image builds never print the token; no public exploit code was identified at time of analysis, and exploitation requires a specific chain of local Docker use, retained verbose logs, and retrieval within the token window.
Cross-namespace data exposure in the Postgres- and SQLite-backed LangGraph stores (langgraph-checkpoint-postgres before 3.1.3 and langgraph-checkpoint-sqlite before 3.1.2) lets an authenticated, low-privileged caller who can influence a namespace label read, overwrite, or delete items stored under a different tenant's namespace. The stores flatten a namespace with ".".join(namespace), so a single label such as ("tenant.bob",) resolves to the same stored text as ("tenant", "bob"); only put/aput validated labels, while get, search, delete, list_namespaces, their async variants, and ops passed straight to batch/abatch accepted dotted labels unchecked. Exposure is deployment-dependent rather than universal: it requires an application that relies on namespace tuples to isolate tenants and passes untrusted input into those calls, InMemoryStore is unaffected because it compares namespace tuples, and there is no public exploit identified at time of analysis. The reported CVSS 4.0 score is 6.0, while the independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
NoSQL injection in the @langchain/mongodb provider (part of langchainjs) before version 1.3.1 lets an authenticated low-privilege user read, modify, or delete another user's stored conversation history when multiple users' chat histories live in a shared MongoDB collection and the application passes an untrusted, attacker-controllable structured sessionId into MongoDBChatMessageHistory. The root cause is that the documented string type for sessionId is only enforced by TypeScript at compile time and is erased at runtime, so a value such as {$regex: "^victim-"} is handed straight into the MongoDB query filter and interpreted as a query operator rather than a literal identifier. Impact is tightly gated: applications that derive sessionId from an authenticated, server-controlled string (the documented correct usage) or that isolate histories per user are not affected, and no public exploit code was identified at time of analysis, with no confirmed active exploitation (CISA KEV).
RediSearch query injection in @langchain/redis (the Redis vector store provider for LangChain.js) prior to version 1.1.1 lets a low-privileged attacker who can influence the values passed into structured RediSearch TAG or TEXT filters inject unescaped RediSearch syntax and thereby broaden or otherwise alter the generated search query. Where an application uses such a filter as a tenant or document-access boundary, the manipulated query can return indexed documents outside the attacker's intended scope, resulting in limited confidentiality impact (read/exposure only, no write, code execution, or availability effect). Exploitation is highly conditional: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.0 base 2.3), no public exploit code has been identified, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided, so overall risk is low; the fix is available in @langchain/redis 1.1.1.
Path traversal in LangSmith Client SDK's TracingMiddleware (versions prior to 0.8.18) enables a trust-boundary crossing where any party with LangSmith workspace trace-read access can exfiltrate arbitrary files from servers running the middleware. An attacker sends a crafted HTTP request to a TracingMiddleware-instrumented server, causing it to read a local filesystem path and upload the contents to LangSmith as a trace attachment, which the attacker then retrieves via their workspace access. No public exploit has been identified at time of analysis, but the low complexity and broadly scoped file read make this a meaningful risk for any multi-tenant or contractor-accessible LangSmith deployment.
Weak hashing in LangGraph's Task Result Cache exposes low-privilege authenticated users to hash collision attacks that can leak cached task results across isolation boundaries. All LangGraph versions through 1.2.4 are affected via the `_freeze` function in `libs/langgraph/langgraph/_internal/_cache.py`. A public proof-of-concept is disclosed at GitHub issue #8009, though the CVSS 4.0 score of 2.3 and AC:H rating reflect genuinely high exploitation difficulty; this is not listed in CISA KEV and no active exploitation has been reported.
Path traversal and sandbox escape in LangChain prior to 1.3.9 allow untrusted inputs - including LLM-generated content steered by adversarial prompts - to escape a configured filesystem root boundary. Three components are affected: a file-search agent middleware that validates a starting directory but not glob patterns or symlink targets; prompt and chain/agent configuration loaders that resolve path fields without root confinement; and path-prefix authorization logic that performs string-prefix comparison without segment boundaries, allowing sibling paths to bypass access controls. No public exploit code has been identified at time of analysis and this CVE does not appear in CISA KEV, but the risk is meaningful for any deployment that exposes LangChain filesystem agents to untrusted user input or LLM prompt injection.
Unsafe deserialization in LangGraph SQLite Checkpoint's JsonPlusSerializer (versions 4.1.0 and prior) allows arbitrary Python object reconstruction from checkpoint payloads stored in a SQLite backing store, enabling code execution at checkpoint load time. Affected deployments are those where an unauthorized party can modify checkpoint bytes at rest - a high-privilege prerequisite (PR:H, AV:A per CVSS) that already implies a significant prior compromise. This is explicitly framed as a defense-in-depth concern: the issue escalates an existing 'checkpoint-store write access' incident into full application runtime code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.
DNS rebinding in langchain-openai before 1.1.14 allows an attacker-controlled hostname to bypass SSRF protection in the image token-counting code path, enabling blind probing of internal network services. The `_url_to_size()` helper performs URL validation and the subsequent HTTP fetch as two independent operations with separate DNS resolution, creating a TOCTOU race window that a malicious domain with a short TTL can exploit to redirect the fetch to a private or localhost address after passing the initial check. Practical impact is bounded: the HTTP response is consumed only by Pillow for image dimension extraction and is never returned or logged, making data exfiltration impossible; SSVC confirms no active exploitation, EPSS sits at the 8th percentile, and no public exploit code exists at time of analysis.
SSRF redirect bypass in langchain-text-splitters prior to 1.1.2 allows attackers who can supply URLs to applications using HTMLHeaderTextSplitter.split_text_from_url() to reach internal network endpoints, localhost services, or cloud instance metadata APIs by exploiting unvalidated HTTP redirects. The function's built-in validate_safe_url() check is circumvented because requests.get() follows 302 redirects by default without revalidating the redirect target - turning a deliberate safety feature into a false guarantee. Data exfiltration is contingent on the application returning or surfacing Document object contents to the URL-supplying party; no public exploit has been identified at time of analysis, and EPSS sits at the 9th percentile.
LangSmith Client SDKs in JavaScript (prior to 0.5.19) and Python (prior to 0.7.31) fail to apply output redaction controls to streaming token events, allowing sensitive LLM-generated content to leak into LangSmith platform storage despite hideOutputs/hide_outputs being enabled. Unauthenticated remote attackers can intercept or access unredacted streamed tokens if they gain visibility into run events, bypassing the intended confidentiality controls.