3.7
Faible
CVE-2026-26013 LangChain is a framework for building agents and LLM-powered applications
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| langchain 1.2 | premières → < 1.2.11 | 1.2.11 |
Autres CVE de langchain
Les 9 CVE de langchain →
CVE-2026-55443
LangChain is a framework for building agents and LLM-powered applications
5.1
Moyenne
CVE-2026-44843
LangChain is a framework for building agents and LLM-powered applications
8.2
Élevée
CVE-2026-40087
LangChain is a framework for building agents and LLM-powered applications
5.3
Moyenne
CVE-2026-34070
LangChain is a framework for building agents and LLM-powered applications
7.5
Élevée