LangChain

A vulnerability in langgraph-api custom authentication for JavaScript and TypeScript handlers allows authenticated users to access Store data outside their assigned namespace via failed authorization rewriting.

An authorization bypass vulnerability in the LangGraph SDK causes the actions= parameter on resource-scoped decorators to be ignored, potentially allowing authenticated users to perform unauthorized operations.

The langchain-nvidia-ai-endpoints library versions prior to 1.4.2 are vulnerable to local file disclosure when attacker-controlled image inputs are passed to ChatNVIDIA or VLM reranking APIs, leading to unauthorized file reading and exfiltration to remote endpoints.

A vulnerability in LiteLLM, tracked as CVE-2024-4786, allows remote authenticated attackers to circumvent established security controls.

A logic flaw in langchain_community SitemapLoader allows attackers to bypass domain restrictions, enabling Server-Side Request Forgery to access internal network resources and exfiltrate sensitive content.

A NoSQL injection vulnerability in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries allows authenticated attackers to bypass tenant isolation boundaries and exfiltrate sensitive data via injected MongoDB query operators.

This brief describes how the creation of Large Language Model (LLM) files, including formats like .gguf, .safetensors, .ggml, and Modelfiles, by local AI inference frameworks such as Ollama, llama.cpp, GPT4All, and LM Studio can be detected on Windows endpoints, indicating potential shadow AI deployments, unauthorized model downloads, or rogue LLM infrastructure which poses data exfiltration risks and policy violations.

The LangSmith SDK is vulnerable to untrusted manifest deserialization when pulling public prompts via `pull_prompt`, potentially leading to SSRF, prompt injection, or sensitive data exposure; CVE-2026-45134.

LangChain is vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists, potentially leading to persistent chat-history poisoning, prompt injection, credential disclosure, or server-side requests.