{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T14:37:29.537Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T14:36:19.763Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"paket","entity":{"id":"package:pypi:langchain-core","slug":"langchain-core-82117efb","identity":"pypi:langchain-core","ecosystem":"pypi","name":"langchain-core","label":"LangChain Core","category":"orchestration","aiRelevant":true,"provider":null,"repositoryCount":5,"occurrenceCount":7,"directRepositoryCount":1,"versionCount":5,"licenseExpressions":["MIT"],"advisoryIds":["GHSA-2g6r-c272-w58r","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54"],"advisoryCount":7,"verifiedAttestation":false,"repositories":[{"id":"opencode:5711","slug":"opencode-5711","name":"Chat","pathWithNamespace":"f13/microservices/chat","versions":["1.4.6","1.4.8"],"evidenceCount":2},{"id":"opencode:11665","slug":"opencode-11665","name":"Chat","pathWithNamespace":"oc000155135727/chat","versions":["1.4.8"],"evidenceCount":2},{"id":"opencode:8742","slug":"opencode-8742","name":"ai-websearch-benchmark","pathWithNamespace":"datenlabor-bmz/ai-websearch-benchmark","versions":["1.2.7"],"evidenceCount":1},{"id":"opencode:4166","slug":"opencode-4166","name":"ai-legal-graph","pathWithNamespace":"iorb/ai-legal-graph","versions":["0.2.28"],"evidenceCount":1},{"id":"opencode:7202","slug":"opencode-7202","name":"MUCGPT","pathWithNamespace":"landeshauptstadt-muenchen/mucgpt","versions":["1.4.7"],"evidenceCount":1}],"versions":[{"version":"0.2.28","repositoryCount":1,"occurrenceCount":1,"ageDays":716,"advisoryIds":["GHSA-2g6r-c272-w58r","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-08-02T21:20:58Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":["GHSA-2g6r-c272-w58r","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54","PYSEC-2026-1517","PYSEC-2026-1518","PYSEC-2026-2193","PYSEC-2026-2562","PYSEC-2026-2563","PYSEC-2026-2564","PYSEC-2026-373"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/langchain-ai/langchain"}],"relatedProjects":[{"id":"github.com/langchain-ai/langchain","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"1.2.7","repositoryCount":1,"occurrenceCount":1,"ageDays":191,"advisoryIds":["GHSA-2g6r-c272-w58r","GHSA-926x-3r5x-gfhw","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-01-09T17:44:24Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":["GHSA-2g6r-c272-w58r","GHSA-926x-3r5x-gfhw","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54","PYSEC-2026-2193","PYSEC-2026-2562","PYSEC-2026-2563","PYSEC-2026-2564"],"links":[{"label":"HOMEPAGE","url":"https://docs.langchain.com/"},{"label":"DOCUMENTATION","url":"https://reference.langchain.com/python/langchain_core/"},{"label":"SOURCE_REPO","url":"https://github.com/langchain-ai/langchain"}],"relatedProjects":[{"id":"github.com/langchain-ai/langchain","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"1.4.6","repositoryCount":1,"occurrenceCount":1,"ageDays":39,"advisoryIds":[],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-06-11T07:09:53Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":[],"links":[{"label":"HOMEPAGE","url":"https://docs.langchain.com/"},{"label":"DOCUMENTATION","url":"https://reference.langchain.com/python/langchain_core/"},{"label":"ISSUE_TRACKER","url":"https://github.com/langchain-ai/langchain/issues"},{"label":"SOURCE_REPO","url":"https://github.com/langchain-ai/langchain"}],"relatedProjects":[{"id":"github.com/langchain-ai/langchain","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/langchain-ai/langchain","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"1.4.7","repositoryCount":1,"occurrenceCount":1,"ageDays":37,"advisoryIds":[],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-06-12T19:23:55Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":[],"links":[{"label":"SOURCE_REPO","url":"https://github.com/langchain-ai/langchain"},{"label":"HOMEPAGE","url":"https://docs.langchain.com/"},{"label":"DOCUMENTATION","url":"https://reference.langchain.com/python/langchain_core/"},{"label":"ISSUE_TRACKER","url":"https://github.com/langchain-ai/langchain/issues"}],"relatedProjects":[{"id":"github.com/langchain-ai/langchain","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/langchain-ai/langchain","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"1.4.8","repositoryCount":2,"occurrenceCount":3,"ageDays":31,"advisoryIds":[],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-06-18T19:39:21Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":[],"links":[{"label":"HOMEPAGE","url":"https://docs.langchain.com/"},{"label":"DOCUMENTATION","url":"https://reference.langchain.com/python/langchain_core/"},{"label":"ISSUE_TRACKER","url":"https://github.com/langchain-ai/langchain/issues"},{"label":"SOURCE_REPO","url":"https://github.com/langchain-ai/langchain"}],"relatedProjects":[{"id":"github.com/langchain-ai/langchain","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/langchain-ai/langchain","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:99c864d2014f28f32a985129","repositoryId":"opencode:4166","repositorySlug":"opencode-4166","repositoryName":"ai-legal-graph","repositoryPathWithNamespace":"iorb/ai-legal-graph","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"0.2.28","versionKey":"pypi:langchain-core@0.2.28","direct":true,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements.txt","blobSha":"eb8e9a474c655bc81e1a5841cf757dec75775529","sourceUrl":"https://gitlab.opencode.de/iorb/ai-legal-graph/-/blob/8c26aa4fed1fcb1be4ecfbbf745144dbf812e4be/requirements.txt","commitSha":"8c26aa4fed1fcb1be4ecfbbf745144dbf812e4be"},{"id":"component:4404adc4909c2a7600adad53","repositoryId":"opencode:8742","repositorySlug":"opencode-8742","repositoryName":"ai-websearch-benchmark","repositoryPathWithNamespace":"datenlabor-bmz/ai-websearch-benchmark","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"1.2.7","versionKey":"pypi:langchain-core@1.2.7","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"4f7b4e2e096e186e4408b529568676aa8c71ba55","sourceUrl":"https://gitlab.opencode.de/datenlabor-bmz/ai-websearch-benchmark/-/blob/cd6b854b1b400d7e45796aaa22bded8183642916/uv.lock","commitSha":"cd6b854b1b400d7e45796aaa22bded8183642916"},{"id":"component:f82f82148aa9ec501ae59eeb","repositoryId":"opencode:5711","repositorySlug":"opencode-5711","repositoryName":"Chat","repositoryPathWithNamespace":"f13/microservices/chat","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"1.4.6","versionKey":"pypi:langchain-core@1.4.6","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-dev.txt","blobSha":"cb5de92f20847716cb1365424c1487ef7737c5a3","sourceUrl":"https://gitlab.opencode.de/f13/microservices/chat/-/blob/a93870fdf9bd76e9b0e5000a4c35906b58dc77d5/requirements-dev.txt","commitSha":"a93870fdf9bd76e9b0e5000a4c35906b58dc77d5"},{"id":"component:179053f698ed63ced95d1d26","repositoryId":"opencode:11665","repositorySlug":"opencode-11665","repositoryName":"Chat","repositoryPathWithNamespace":"oc000155135727/chat","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"1.4.8","versionKey":"pypi:langchain-core@1.4.8","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-dev.txt","blobSha":"fd14e62cdbbceb707e82de32261f078ce7e761e6","sourceUrl":"https://gitlab.opencode.de/oc000155135727/chat/-/blob/5a50523649346b69cc333b11dd289783f02c7a44/requirements-dev.txt","commitSha":"5a50523649346b69cc333b11dd289783f02c7a44"},{"id":"component:bd3370af9037d4617e3e85b8","repositoryId":"opencode:11665","repositorySlug":"opencode-11665","repositoryName":"Chat","repositoryPathWithNamespace":"oc000155135727/chat","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"1.4.8","versionKey":"pypi:langchain-core@1.4.8","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements.txt","blobSha":"609077cf5528aa4d11e7334fbb27ee972681b7b2","sourceUrl":"https://gitlab.opencode.de/oc000155135727/chat/-/blob/5a50523649346b69cc333b11dd289783f02c7a44/requirements.txt","commitSha":"5a50523649346b69cc333b11dd289783f02c7a44"},{"id":"component:676923b3ec11ad67fd5cf110","repositoryId":"opencode:5711","repositorySlug":"opencode-5711","repositoryName":"Chat","repositoryPathWithNamespace":"f13/microservices/chat","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"1.4.8","versionKey":"pypi:langchain-core@1.4.8","direct":false,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements.txt","blobSha":"a6eda97cd26e2e09417c240a3db1e9a304e099d2","sourceUrl":"https://gitlab.opencode.de/f13/microservices/chat/-/blob/a93870fdf9bd76e9b0e5000a4c35906b58dc77d5/requirements.txt","commitSha":"a93870fdf9bd76e9b0e5000a4c35906b58dc77d5"},{"id":"component:6ba1c72de177756cee5be860","repositoryId":"opencode:7202","repositorySlug":"opencode-7202","repositoryName":"MUCGPT","repositoryPathWithNamespace":"landeshauptstadt-muenchen/mucgpt","ecosystem":"pypi","name":"langchain-core","identity":"pypi:langchain-core","version":"1.4.7","versionKey":"pypi:langchain-core@1.4.7","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"mucgpt-core-service/uv.lock","blobSha":"8bf6980137a09f5692c9e62798298a2cd9122a99","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/mucgpt/-/blob/46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8/mucgpt-core-service/uv.lock","commitSha":"46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8"}],"occurrenceCount":7},"related":{"repositories":[{"id":"opencode:5711","slug":"opencode-5711","name":"Chat","pathWithNamespace":"f13/microservices/chat","versions":["1.4.6","1.4.8"],"evidenceCount":2},{"id":"opencode:11665","slug":"opencode-11665","name":"Chat","pathWithNamespace":"oc000155135727/chat","versions":["1.4.8"],"evidenceCount":2},{"id":"opencode:8742","slug":"opencode-8742","name":"ai-websearch-benchmark","pathWithNamespace":"datenlabor-bmz/ai-websearch-benchmark","versions":["1.2.7"],"evidenceCount":1},{"id":"opencode:4166","slug":"opencode-4166","name":"ai-legal-graph","pathWithNamespace":"iorb/ai-legal-graph","versions":["0.2.28"],"evidenceCount":1},{"id":"opencode:7202","slug":"opencode-7202","name":"MUCGPT","pathWithNamespace":"landeshauptstadt-muenchen/mucgpt","versions":["1.4.7"],"evidenceCount":1}],"vulnerabilities":[{"id":"GHSA-2g6r-c272-w58r","slug":"ghsa-2g6r-c272-w58r-4bbbcb01","dossier":false,"summary":"LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages","aliases":["CVE-2026-26013","PYSEC-2026-2562"],"sourceIds":["GHSA-2g6r-c272-w58r","PYSEC-2026-2562"],"published":"2026-02-11T14:23:13Z","modified":"2026-07-13T16:43:30.756724986Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-2g6r-c272-w58r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26013"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/2b4b1dc29a833d4053deba4c2b77a3848c834565"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.11"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g6r-c272-w58r"}],"versionKeys":["pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-5chr-fjjv-38qv","slug":"ghsa-5chr-fjjv-38qv-5f3dd755","dossier":false,"summary":"langchain-core allows unauthorized users to read arbitrary files from the host file system","aliases":["CVE-2024-10940","PYSEC-2026-1517"],"sourceIds":["GHSA-5chr-fjjv-38qv","PYSEC-2026-1517"],"published":"2025-03-20T12:32:41Z","modified":"2026-07-07T17:56:35.905913395Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10940"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"WEB","url":"https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5chr-fjjv-38qv"}],"versionKeys":["pypi:langchain-core@0.2.28"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-6qv9-48xg-fc7f","slug":"ghsa-6qv9-48xg-fc7f-6f0bc426","dossier":false,"summary":"LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates","aliases":["CVE-2025-65106","PYSEC-2026-1518"],"sourceIds":["GHSA-6qv9-48xg-fc7f","PYSEC-2026-1518"],"published":"2025-11-20T17:42:12Z","modified":"2026-07-07T17:57:16.939269197Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65106"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6qv9-48xg-fc7f"}],"versionKeys":["pypi:langchain-core@0.2.28"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-926x-3r5x-gfhw","slug":"ghsa-926x-3r5x-gfhw-b7d12e65","dossier":false,"summary":"LangChain has incomplete f-string validation in prompt templates","aliases":["CVE-2026-40087","PYSEC-2026-2563"],"sourceIds":["GHSA-926x-3r5x-gfhw","PYSEC-2026-2563"],"published":"2026-04-08T21:51:32Z","modified":"2026-07-13T16:42:42.901211235Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-926x-3r5x-gfhw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40087"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/pull/36612"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/pull/36613"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/6bab0ba3c12328008ddca3e0d54ff5a6151cd27b"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/af2ed47c6f008cdd551f3c0d87db3774c8dfe258"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.84"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.28"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-926x-3r5x-gfhw"}],"versionKeys":["pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-c67j-w6g6-q2cm","slug":"ghsa-c67j-w6g6-q2cm-a4c5c0cf","dossier":false,"summary":"LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs","aliases":["CVE-2025-68664","PYSEC-2026-373"],"sourceIds":["GHSA-c67j-w6g6-q2cm","PYSEC-2026-373"],"published":"2025-12-23T18:46:13Z","modified":"2026-07-02T13:00:05.018724776Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68664"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/pull/34455"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/pull/34458"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-c67j-w6g6-q2cm"}],"versionKeys":["pypi:langchain-core@0.2.28"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pjwx-r37v-7724","slug":"ghsa-pjwx-r37v-7724-2297a72a","dossier":false,"summary":"LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists","aliases":["CVE-2026-44843","PYSEC-2026-2564"],"sourceIds":["GHSA-pjwx-r37v-7724","PYSEC-2026-2564"],"published":"2026-05-08T23:07:32Z","modified":"2026-07-13T16:42:39.210995356Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44843"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pjwx-r37v-7724"}],"versionKeys":["pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-qh6h-p6c9-ff54","slug":"ghsa-qh6h-p6c9-ff54-caf42ff5","dossier":false,"summary":"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions","aliases":["CVE-2026-34070","PYSEC-2026-2193"],"sourceIds":["GHSA-qh6h-p6c9-ff54","PYSEC-2026-2193"],"published":"2026-03-27T19:45:00Z","modified":"2026-07-13T07:26:33.913236655Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34070"},{"type":"FIX","url":"https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"ADVISORY","url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-34070"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34070.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24766"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453287"}],"versionKeys":["pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7"],"packageCount":1,"repositoryCount":2}]}}