3.7
Low
CVE-2026-26013 LangChain is a framework for building agents and LLM-powered applications
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| langchain 1.2 | earliest → < 1.2.11 | 1.2.11 |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of langchain
The 9 CVEs of langchain →
CVE-2026-55443
LangChain is a framework for building agents and LLM-powered applications
5.1
Medium
CVE-2026-44843
LangChain is a framework for building agents and LLM-powered applications
8.2
High
CVE-2026-40087
LangChain is a framework for building agents and LLM-powered applications
5.3
Medium
CVE-2026-34070
LangChain is a framework for building agents and LLM-powered applications
7.5
High