pypi package reportIs langchain safe?
22 known vulnerabilities, worst severity CRITICAL.
// reach23 direct dependencies
7 carry known advisories, worst CRITICAL
104 packages depend on it
an advisory here reaches each of them
// ai model usageNo published models are known to use this package.
cvssCVSS v3.1 base score out of 10
epsschance of exploitation in 30 days
xyz scoreCyberXYZ composite out of 10
fig. 01 — GHSA-8h5w-f6q9-wg35, the advisory selected below
// 22 advisories
In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Checked 2026-11-06 at 21:46 UTC. The most recent advisory here was published 2026-06-16. Updated continuously from NVD, GHSA, OSV and CNA feeds.