[{"data":1,"prerenderedAt":588},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-11665":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":42,"summary":61,"kind":77,"entity":78,"evidence":114,"related":126},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-07-20T11:49:05.682Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-07-20T11:47:56.369Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.28.0","2026-02-20T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":31,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":36,"parsedFileCount":37,"parseErrorCount":32,"unsupportedFileCount":38,"evaluatedVersionCount":39,"metadataResolvedCount":40,"metadataNotFoundCount":41,"osvEvaluatedVersionCount":39,"codeRadarRepositoryCount":30},30,29,1,17,4,20,33,32,0,4205,4191,14,{"componentParserSchemaVersion":43,"candidateBoundary":44,"resolvedVersionBoundary":45,"manifestRangesResolved":46,"latestVersionSubstitution":46,"containerTagsVulnerabilityChecked":46,"osvClaim":47,"depsDevLicenseSemantics":48,"providerSemantics":49,"generativeAiUsed":46,"scoreUsed":46,"treeEntryCeiling":50,"fileByteCeiling":51,"uniqueVersionCeiling":52,"observedFormats":53},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,5000,[54,55,56,57,58,59,60],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":62,"aiPackageCount":63,"resolvedComponentCount":64,"resolvedVersionCount":39,"providerExposureRepositoryCount":65,"licenseExpressionCount":66,"knownLicensePackageCount":67,"unknownLicensePackageCount":68,"advisoryCount":69,"matchedAdvisoryRepositoryCount":70,"topPackage":71},2831,41,7181,7,57,2796,35,572,25,{"id":72,"slug":73,"label":74,"repositoryCount":75,"repositoryShare":76},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",18,0.6,"repository",{"id":79,"slug":80,"gitlabProjectId":81,"name":82,"pathWithNamespace":83,"description":84,"webUrl":85,"commitSha":86,"commitUrl":87,"lastActivityAt":88,"headCommittedAt":89,"tree":90,"files":93,"resolvedComponentCount":75,"artifactResolvedComponentCount":38,"exactManifestPinCount":75,"packageCount":94,"ecosystems":95,"aiPackageCount":94,"licenseExpressionCount":97,"unknownLicensePackageCount":38,"advisoryIds":98,"advisoryCount":112,"providers":113},"opencode:11665","opencode-11665",11665,"Chat","oc000155135727\u002Fchat","Chat-Microservice mit lokal deployten oder extern verfügbaren Sprachmodellen","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat","5a50523649346b69cc333b11dd289783f02c7a44","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat\u002F-\u002Fcommit\u002F5a50523649346b69cc333b11dd289783f02c7a44","2026-07-10T12:02:10.529Z","2026-07-01T11:54:34.000Z",{"complete":91,"entryCount":92,"truncated":46},true,124,[],9,[96],"pypi",3,[99,100,101,102,103,104,105,106,107,108,109,110,111],"GHSA-2g6r-c272-w58r","GHSA-3644-q5cj-c5c7","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-g48c-2wqr-h844","GHSA-gr75-jv2w-4656","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54","GHSA-r7w7-9xr2-qq2r","GHSA-w39p-vh2g-g8g5","PYSEC-2024-323",13,[],{"files":115,"occurrenceCount":75},[116,122],{"path":117,"kind":118,"sourceUrl":119,"commitSha":86,"blobSha":120,"state":121,"componentCount":94},"requirements-dev.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat\u002F-\u002Fblob\u002F5a50523649346b69cc333b11dd289783f02c7a44\u002Frequirements-dev.txt","fd14e62cdbbceb707e82de32261f078ce7e761e6","parsed",{"path":123,"kind":118,"sourceUrl":124,"commitSha":86,"blobSha":125,"state":121,"componentCount":94},"requirements.txt","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat\u002F-\u002Fblob\u002F5a50523649346b69cc333b11dd289783f02c7a44\u002Frequirements.txt","609077cf5528aa4d11e7334fbb27ee972681b7b2",{"packages":127,"vulnerabilities":215},[128,140,149,158,170,178,187,196,205],{"id":129,"slug":130,"identity":131,"label":132,"aiRelevant":91,"provider":133,"advisoryCount":65,"licenseExpressions":134,"versions":136,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":139},"package:pypi:langchain-core","langchain-core-82117efb","pypi:langchain-core","LangChain Core",null,[135],"MIT",[137],"1.4.8",2,[117,123],{"id":141,"slug":142,"identity":143,"label":144,"aiRelevant":91,"provider":133,"advisoryCount":97,"licenseExpressions":145,"versions":146,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":148},"package:pypi:langchain","langchain-2b3b6a0b","pypi:langchain","LangChain",[135],[147],"1.3.11",[117,123],{"id":150,"slug":151,"identity":152,"label":153,"aiRelevant":91,"provider":133,"advisoryCount":138,"licenseExpressions":154,"versions":155,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":157},"package:pypi:langgraph","langgraph-6c1c645e","pypi:langgraph","LangGraph",[135],[156],"1.2.7",[117,123],{"id":159,"slug":160,"identity":161,"label":162,"aiRelevant":91,"provider":163,"advisoryCount":32,"licenseExpressions":166,"versions":167,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":169},"package:pypi:langchain-openai","langchain-openai-4985188e","pypi:langchain-openai","LangChain OpenAI",{"id":164,"label":165},"openai","OpenAI",[135],[168],"1.3.3",[117,123],{"id":72,"slug":73,"identity":171,"label":74,"aiRelevant":91,"provider":172,"advisoryCount":38,"licenseExpressions":173,"versions":175,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":177},"pypi:openai",{"id":164,"label":165},[174],"Apache-2.0",[176],"2.44.0",[117,123],{"id":179,"slug":180,"identity":181,"label":182,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":183,"versions":184,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":186},"package:pypi:langchain-linkup","langchain-linkup-d50e0d4b","pypi:langchain-linkup","LangChain · Linkup",[135],[185],"0.2.1",[117,123],{"id":188,"slug":189,"identity":190,"label":191,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":192,"versions":193,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":195},"package:pypi:langchain-protocol","langchain-protocol-2715aeed","pypi:langchain-protocol","LangChain · Protocol",[135],[194],"0.0.18",[117,123],{"id":197,"slug":198,"identity":199,"label":200,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":201,"versions":202,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":204},"package:pypi:langchain-tavily","langchain-tavily-432e1c93","pypi:langchain-tavily","LangChain · Tavily",[135],[203],"0.2.18",[117,123],{"id":206,"slug":207,"identity":208,"label":209,"aiRelevant":91,"provider":133,"advisoryCount":38,"licenseExpressions":210,"versions":212,"dossier":91,"occurrenceCount":138,"directOccurrenceCount":38,"evidenceFiles":214},"package:pypi:tiktoken","tiktoken-06b251a3","pypi:tiktoken","tiktoken",[211],"non-standard",[213],"0.13.0",[117,123],[216,250,284,312,339,373,407,434,461,483,518,541,570],{"id":99,"slug":217,"dossier":46,"summary":218,"aliases":219,"sourceIds":222,"published":223,"modified":224,"checkedAt":7,"severity":225,"references":229,"versionKeys":247,"packageCount":32,"repositoryCount":138},"ghsa-2g6r-c272-w58r-4bbbcb01","LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages",[220,221],"CVE-2026-26013","PYSEC-2026-2562",[99,221],"2026-02-11T14:23:13Z","2026-07-13T16:43:30.756724986Z",[226],{"type":227,"score":228},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[230,233,236,238,241,243,245],{"type":231,"url":232},"WEB","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",{"type":234,"url":235},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26013",{"type":231,"url":237},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F2b4b1dc29a833d4053deba4c2b77a3848c834565",{"type":239,"url":240},"PACKAGE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain",{"type":231,"url":242},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.11",{"type":239,"url":244},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-core",{"type":234,"url":246},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",[248,249],"pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7",{"id":100,"slug":251,"dossier":46,"summary":252,"aliases":253,"sourceIds":258,"published":259,"modified":260,"checkedAt":7,"severity":261,"references":264,"versionKeys":279,"packageCount":97,"repositoryCount":97},"ghsa-3644-q5cj-c5c7-4c578cf2","LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning",[254,255,256,257],"CVE-2026-45134","PYSEC-2026-2555","PYSEC-2026-2560","PYSEC-2026-2582",[100,255,256,257],"2026-05-13T15:29:30Z","2026-07-13T16:43:39.736848907Z",[262],{"type":227,"score":263},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[265,267,269,271,273,275,277],{"type":231,"url":266},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk\u002Fsecurity\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":234,"url":268},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45134",{"type":239,"url":270},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk",{"type":239,"url":272},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain",{"type":234,"url":274},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":239,"url":276},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-classic",{"type":239,"url":278},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangsmith",[280,281,282,283],"pypi:langchain-classic@1.0.1","pypi:langchain@0.2.7","pypi:langchain@0.3.7","pypi:langsmith@0.6.4",{"id":101,"slug":285,"dossier":46,"summary":286,"aliases":287,"sourceIds":290,"published":291,"modified":292,"checkedAt":7,"severity":293,"references":296,"versionKeys":311,"packageCount":32,"repositoryCount":32},"ghsa-5chr-fjjv-38qv-5f3dd755","langchain-core allows unauthorized users to read arbitrary files from the host file system",[288,289],"CVE-2024-10940","PYSEC-2026-1517",[101,289],"2025-03-20T12:32:41Z","2026-07-07T17:56:35.905913395Z",[294],{"type":227,"score":295},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[297,299,301,303,305,306,308,309],{"type":234,"url":298},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-10940",{"type":231,"url":300},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F7d481f10102f43559cc57bcad7eba291067939ee",{"type":231,"url":302},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc1e742347f9701aadba8920e4d1f79a636e50b68",{"type":231,"url":304},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fe711034713259ae448981bc0fd1d7a5671499c31",{"type":239,"url":240},{"type":231,"url":307},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fbe1ee1cb-2147-4ff4-a57b-b6045271cf27",{"type":239,"url":244},{"type":234,"url":310},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5chr-fjjv-38qv",[248],{"id":102,"slug":313,"dossier":46,"summary":314,"aliases":315,"sourceIds":318,"published":319,"modified":320,"checkedAt":7,"severity":321,"references":325,"versionKeys":338,"packageCount":32,"repositoryCount":32},"ghsa-6qv9-48xg-fc7f-6f0bc426","LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates",[316,317],"CVE-2025-65106","PYSEC-2026-1518",[102,317],"2025-11-20T17:42:12Z","2026-07-07T17:57:16.939269197Z",[322],{"type":323,"score":324},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[326,328,330,332,334,335,336],{"type":231,"url":327},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",{"type":234,"url":329},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-65106",{"type":231,"url":331},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc4b6ba254e1a49ed91f2e268e6484011c540542a",{"type":231,"url":333},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Ffa7789d6c21222b85211755d822ef698d3b34e00",{"type":239,"url":240},{"type":239,"url":244},{"type":234,"url":337},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",[248],{"id":103,"slug":340,"dossier":46,"summary":341,"aliases":342,"sourceIds":345,"published":346,"modified":347,"checkedAt":7,"severity":348,"references":351,"versionKeys":372,"packageCount":32,"repositoryCount":138},"ghsa-926x-3r5x-gfhw-b7d12e65","LangChain has incomplete f-string validation in prompt templates",[343,344],"CVE-2026-40087","PYSEC-2026-2563",[103,344],"2026-04-08T21:51:32Z","2026-07-13T16:42:42.901211235Z",[349],{"type":227,"score":350},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[352,354,356,358,360,362,364,365,367,369,370],{"type":231,"url":353},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",{"type":234,"url":355},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40087",{"type":231,"url":357},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36612",{"type":231,"url":359},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36613",{"type":231,"url":361},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F6bab0ba3c12328008ddca3e0d54ff5a6151cd27b",{"type":231,"url":363},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Faf2ed47c6f008cdd551f3c0d87db3774c8dfe258",{"type":239,"url":240},{"type":231,"url":366},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.84",{"type":231,"url":368},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.28",{"type":239,"url":244},{"type":234,"url":371},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",[248,249],{"id":104,"slug":374,"dossier":46,"summary":375,"aliases":376,"sourceIds":379,"published":380,"modified":381,"checkedAt":7,"severity":382,"references":385,"versionKeys":406,"packageCount":32,"repositoryCount":32},"ghsa-c67j-w6g6-q2cm-a4c5c0cf","LangChain serialization injection vulnerability enables secret extraction in dumps\u002Floads APIs",[377,378],"CVE-2025-68664","PYSEC-2026-373",[104,378],"2025-12-23T18:46:13Z","2026-07-02T13:00:05.018724776Z",[383],{"type":227,"score":384},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:L\u002FA:N",[386,388,390,392,394,396,398,399,401,403,404],{"type":231,"url":387},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",{"type":234,"url":389},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68664",{"type":231,"url":391},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34455",{"type":231,"url":393},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34458",{"type":231,"url":395},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8",{"type":231,"url":397},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fd9ec4c5cc78960abd37da79b0250f5642e6f0ce6",{"type":239,"url":240},{"type":231,"url":400},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.81",{"type":231,"url":402},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.5",{"type":239,"url":244},{"type":234,"url":405},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",[248],{"id":105,"slug":408,"dossier":46,"summary":409,"aliases":410,"sourceIds":413,"published":414,"modified":415,"checkedAt":7,"severity":416,"references":421,"versionKeys":430,"packageCount":32,"repositoryCount":97},"ghsa-g48c-2wqr-h844-48f35247","LangGraph checkpoint loading has unsafe msgpack deserialization",[411,412],"CVE-2026-28277","PYSEC-2026-83",[105,412],"2026-03-05T20:16:15.677Z","2026-06-06T01:00:08.116125988Z",[417,419],{"type":227,"score":418},"CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":227,"score":420},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[422,424,426,428],{"type":234,"url":423},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-g48c-2wqr-h844",{"type":234,"url":425},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28277",{"type":239,"url":427},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph",{"type":231,"url":429},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-83.yaml",[431,432,433],"pypi:langgraph@0.1.1","pypi:langgraph@0.3.21","pypi:langgraph@1.0.6",{"id":106,"slug":435,"dossier":46,"summary":436,"aliases":437,"sourceIds":441,"published":442,"modified":443,"checkedAt":7,"severity":444,"references":449,"versionKeys":458,"packageCount":32,"repositoryCount":34},"ghsa-gr75-jv2w-4656-a5b8c61e","LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders",[438,439,440],"CVE-2026-55443","PYSEC-2026-2192","PYSEC-2026-2556",[106,439],"2026-06-16T15:03:14Z","2026-07-13T16:43:09.845932020Z",[445,447],{"type":227,"score":446},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":227,"score":448},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[450,452,454,457],{"type":234,"url":451},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-gr75-jv2w-4656",{"type":234,"url":453},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55443",{"type":455,"url":456},"FIX","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fdcaf7795a3e6590af55c3ff7bda6add6355e9ea6",{"type":239,"url":240},[281,282,459,460],"pypi:langchain@1.2.6","pypi:langchain@1.3.8",{"id":107,"slug":462,"dossier":46,"summary":463,"aliases":464,"sourceIds":467,"published":468,"modified":469,"checkedAt":7,"severity":470,"references":473,"versionKeys":482,"packageCount":32,"repositoryCount":138},"ghsa-pjwx-r37v-7724-2297a72a","LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists",[465,466],"CVE-2026-44843","PYSEC-2026-2564",[107,466],"2026-05-08T23:07:32Z","2026-07-13T16:42:39.210995356Z",[471],{"type":227,"score":472},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[474,476,478,479,480],{"type":231,"url":475},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",{"type":234,"url":477},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44843",{"type":239,"url":240},{"type":239,"url":244},{"type":234,"url":481},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",[248,249],{"id":108,"slug":484,"dossier":46,"summary":485,"aliases":486,"sourceIds":489,"published":490,"modified":491,"checkedAt":7,"severity":492,"references":495,"versionKeys":517,"packageCount":32,"repositoryCount":138},"ghsa-qh6h-p6c9-ff54-caf42ff5","LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions",[487,488],"CVE-2026-34070","PYSEC-2026-2193",[108,488],"2026-03-27T19:45:00Z","2026-07-13T07:26:33.913236655Z",[493],{"type":227,"score":494},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[496,499,501,503,504,506,508,510,512,514],{"type":497,"url":498},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-qh6h-p6c9-ff54",{"type":234,"url":500},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34070",{"type":455,"url":502},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F27add913474e01e33bededf4096151130ba0d47c",{"type":239,"url":240},{"type":234,"url":505},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core==1.2.22",{"type":231,"url":507},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34070",{"type":231,"url":509},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34070.json",{"type":234,"url":511},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24766",{"type":234,"url":513},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":515,"url":516},"REPORT","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2453287",[248,249],{"id":109,"slug":519,"dossier":46,"summary":520,"aliases":521,"sourceIds":524,"published":525,"modified":526,"checkedAt":7,"severity":527,"references":530,"versionKeys":538,"packageCount":32,"repositoryCount":138},"ghsa-r7w7-9xr2-qq2r-7a3a0a91","langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding",[522,523],"CVE-2026-41488","PYSEC-2026-76",[109,523],"2026-04-16T23:00:12Z","2026-06-06T01:15:07.912179267Z",[528],{"type":227,"score":529},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[531,533,535,536],{"type":234,"url":532},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-r7w7-9xr2-qq2r",{"type":234,"url":534},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41488",{"type":239,"url":240},{"type":231,"url":537},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flangchain-openai\u002FPYSEC-2026-76.yaml",[539,540],"pypi:langchain-openai@0.2.8","pypi:langchain-openai@1.1.7",{"id":110,"slug":542,"dossier":46,"summary":543,"aliases":544,"sourceIds":548,"published":549,"modified":550,"checkedAt":7,"severity":551,"references":556,"versionKeys":568,"packageCount":138,"repositoryCount":138},"ghsa-w39p-vh2g-g8g5-47880dfe","LangGraph SDK has unsafe URL path construction",[545,546,547],"CVE-2026-48776","PYSEC-2026-2194","PYSEC-2026-2575",[110,546,547],"2026-06-17T10:55:15.113Z","2026-07-13T16:42:27.619863658Z",[552,554],{"type":227,"score":553},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":227,"score":555},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[557,559,561,562,564,566],{"type":231,"url":558},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":234,"url":560},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48776",{"type":239,"url":427},{"type":231,"url":563},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Freleases\u002Ftag\u002Fsdk%3D%3D0.3.15",{"type":239,"url":565},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flanggraph-sdk",{"type":234,"url":567},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",[569,431],"pypi:langgraph-sdk@0.3.3",{"id":111,"slug":571,"dossier":46,"summary":133,"aliases":572,"sourceIds":576,"published":577,"modified":578,"checkedAt":7,"severity":579,"references":582,"versionKeys":587,"packageCount":32,"repositoryCount":32},"pysec-2024-323-1dd96856",[573,574,575],"CVE-2024-5998","GHSA-f2jm-rw3h-6phg","PYSEC-2026-1514",[111],"2024-09-17T12:15:02.977Z","2026-07-13T07:26:23.643495355Z",[580],{"type":227,"score":581},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[583,585],{"type":455,"url":584},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F604dfe2d99246b0c09f047c604f0c63eafba31e7",{"type":497,"url":586},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Ffa3a2753-57c3-4e08-a176-d7a3ffda28fe",[281],1784548467115]