[{"data":1,"prerenderedAt":591},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-11665":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":41,"summary":60,"kind":75,"entity":76,"evidence":112,"related":124},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-08-13T02:29:21.454Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-08-13T02:28:06.466Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.28.0","2026-02-20T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":31,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":36,"parsedFileCount":30,"parseErrorCount":32,"unsupportedFileCount":37,"evaluatedVersionCount":38,"metadataResolvedCount":39,"metadataNotFoundCount":40,"osvEvaluatedVersionCount":38,"codeRadarRepositoryCount":30},31,30,1,18,4,21,32,0,3642,3632,10,{"componentParserSchemaVersion":42,"candidateBoundary":43,"resolvedVersionBoundary":44,"manifestRangesResolved":45,"latestVersionSubstitution":45,"containerTagsVulnerabilityChecked":45,"osvClaim":46,"depsDevLicenseSemantics":47,"providerSemantics":48,"generativeAiUsed":45,"scoreUsed":45,"treeEntryCeiling":49,"fileByteCeiling":50,"uniqueVersionCeiling":51,"observedFormats":52},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[53,54,55,56,57,58,59],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":61,"aiPackageCount":62,"resolvedComponentCount":63,"resolvedVersionCount":38,"providerExposureRepositoryCount":64,"licenseExpressionCount":65,"knownLicensePackageCount":66,"unknownLicensePackageCount":31,"advisoryCount":67,"matchedAdvisoryRepositoryCount":68,"topPackage":69},2274,44,5994,6,53,2244,640,26,{"id":70,"slug":71,"label":72,"repositoryCount":73,"repositoryShare":74},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",19,0.6129032258064516,"repository",{"id":77,"slug":78,"gitlabProjectId":79,"name":80,"pathWithNamespace":81,"description":82,"webUrl":83,"commitSha":84,"commitUrl":85,"lastActivityAt":86,"headCommittedAt":87,"tree":88,"files":91,"resolvedComponentCount":33,"artifactResolvedComponentCount":37,"exactManifestPinCount":33,"packageCount":92,"ecosystems":93,"aiPackageCount":92,"licenseExpressionCount":95,"unknownLicensePackageCount":37,"advisoryIds":96,"advisoryCount":110,"providers":111},"opencode:11665","opencode-11665",11665,"Chat","oc000155135727\u002Fchat","Chat-Microservice mit lokal deployten oder extern verfügbaren Sprachmodellen","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat","5a50523649346b69cc333b11dd289783f02c7a44","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat\u002F-\u002Fcommit\u002F5a50523649346b69cc333b11dd289783f02c7a44","2026-07-24T17:18:31.705Z","2026-07-01T11:54:34.000Z",{"complete":89,"entryCount":90,"truncated":45},true,124,[],9,[94],"pypi",3,[97,98,99,100,101,102,103,104,105,106,107,108,109],"GHSA-2g6r-c272-w58r","GHSA-3644-q5cj-c5c7","GHSA-5chr-fjjv-38qv","GHSA-6qv9-48xg-fc7f","GHSA-926x-3r5x-gfhw","GHSA-c67j-w6g6-q2cm","GHSA-g48c-2wqr-h844","GHSA-gr75-jv2w-4656","GHSA-pjwx-r37v-7724","GHSA-qh6h-p6c9-ff54","GHSA-r7w7-9xr2-qq2r","GHSA-w39p-vh2g-g8g5","PYSEC-2024-323",13,[],{"files":113,"occurrenceCount":33},[114,120],{"path":115,"kind":116,"sourceUrl":117,"commitSha":84,"blobSha":118,"state":119,"componentCount":92},"requirements-dev.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat\u002F-\u002Fblob\u002F5a50523649346b69cc333b11dd289783f02c7a44\u002Frequirements-dev.txt","fd14e62cdbbceb707e82de32261f078ce7e761e6","parsed",{"path":121,"kind":116,"sourceUrl":122,"commitSha":84,"blobSha":123,"state":119,"componentCount":92},"requirements.txt","https:\u002F\u002Fgitlab.opencode.de\u002Foc000155135727\u002Fchat\u002F-\u002Fblob\u002F5a50523649346b69cc333b11dd289783f02c7a44\u002Frequirements.txt","609077cf5528aa4d11e7334fbb27ee972681b7b2",{"packages":125,"vulnerabilities":214},[126,139,148,157,169,177,186,195,204],{"id":127,"slug":128,"identity":129,"label":130,"aiRelevant":89,"provider":131,"advisoryCount":132,"licenseExpressions":133,"versions":135,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":138},"package:pypi:langchain-core","langchain-core-82117efb","pypi:langchain-core","LangChain Core",null,7,[134],"MIT",[136],"1.4.8",2,[115,121],{"id":140,"slug":141,"identity":142,"label":143,"aiRelevant":89,"provider":131,"advisoryCount":95,"licenseExpressions":144,"versions":145,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":147},"package:pypi:langchain","langchain-2b3b6a0b","pypi:langchain","LangChain",[134],[146],"1.3.11",[115,121],{"id":149,"slug":150,"identity":151,"label":152,"aiRelevant":89,"provider":131,"advisoryCount":137,"licenseExpressions":153,"versions":154,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":156},"package:pypi:langgraph","langgraph-6c1c645e","pypi:langgraph","LangGraph",[134],[155],"1.2.7",[115,121],{"id":158,"slug":159,"identity":160,"label":161,"aiRelevant":89,"provider":162,"advisoryCount":32,"licenseExpressions":165,"versions":166,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":168},"package:pypi:langchain-openai","langchain-openai-4985188e","pypi:langchain-openai","LangChain OpenAI",{"id":163,"label":164},"openai","OpenAI",[134],[167],"1.3.3",[115,121],{"id":70,"slug":71,"identity":170,"label":72,"aiRelevant":89,"provider":171,"advisoryCount":37,"licenseExpressions":172,"versions":174,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":176},"pypi:openai",{"id":163,"label":164},[173],"Apache-2.0",[175],"2.44.0",[115,121],{"id":178,"slug":179,"identity":180,"label":181,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":182,"versions":183,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":185},"package:pypi:langchain-linkup","langchain-linkup-d50e0d4b","pypi:langchain-linkup","LangChain · Linkup",[134],[184],"0.2.1",[115,121],{"id":187,"slug":188,"identity":189,"label":190,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":191,"versions":192,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":194},"package:pypi:langchain-protocol","langchain-protocol-2715aeed","pypi:langchain-protocol","LangChain · Protocol",[134],[193],"0.0.18",[115,121],{"id":196,"slug":197,"identity":198,"label":199,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":200,"versions":201,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":203},"package:pypi:langchain-tavily","langchain-tavily-432e1c93","pypi:langchain-tavily","LangChain · Tavily",[134],[202],"0.2.18",[115,121],{"id":205,"slug":206,"identity":207,"label":208,"aiRelevant":89,"provider":131,"advisoryCount":37,"licenseExpressions":209,"versions":211,"dossier":89,"occurrenceCount":137,"directOccurrenceCount":37,"evidenceFiles":213},"package:pypi:tiktoken","tiktoken-06b251a3","pypi:tiktoken","tiktoken",[210],"non-standard",[212],"0.13.0",[115,121],[215,249,283,311,338,372,406,433,459,481,516,540,573],{"id":97,"slug":216,"dossier":45,"summary":217,"aliases":218,"sourceIds":221,"published":222,"modified":223,"checkedAt":7,"severity":224,"references":228,"versionKeys":246,"packageCount":32,"repositoryCount":137},"ghsa-2g6r-c272-w58r-4bbbcb01","LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages",[219,220],"CVE-2026-26013","PYSEC-2026-2562",[97,220],"2026-02-11T14:23:13Z","2026-07-13T16:43:30.756724986Z",[225],{"type":226,"score":227},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[229,232,235,237,240,242,244],{"type":230,"url":231},"WEB","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",{"type":233,"url":234},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-26013",{"type":230,"url":236},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F2b4b1dc29a833d4053deba4c2b77a3848c834565",{"type":238,"url":239},"PACKAGE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain",{"type":230,"url":241},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.11",{"type":238,"url":243},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-core",{"type":233,"url":245},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2g6r-c272-w58r",[247,248],"pypi:langchain-core@0.2.28","pypi:langchain-core@1.2.7",{"id":98,"slug":250,"dossier":45,"summary":251,"aliases":252,"sourceIds":257,"published":258,"modified":259,"checkedAt":7,"severity":260,"references":263,"versionKeys":278,"packageCount":95,"repositoryCount":95},"ghsa-3644-q5cj-c5c7-4c578cf2","LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning",[253,254,255,256],"CVE-2026-45134","PYSEC-2026-2555","PYSEC-2026-2560","PYSEC-2026-2582",[98,254,255,256],"2026-05-13T15:29:30Z","2026-07-13T16:43:39.736848907Z",[261],{"type":226,"score":262},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[264,266,268,270,272,274,276],{"type":230,"url":265},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk\u002Fsecurity\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":233,"url":267},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45134",{"type":238,"url":269},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangsmith-sdk",{"type":238,"url":271},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain",{"type":233,"url":273},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3644-q5cj-c5c7",{"type":238,"url":275},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangchain-classic",{"type":238,"url":277},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flangsmith",[279,280,281,282],"pypi:langchain-classic@1.0.1","pypi:langchain@0.2.7","pypi:langchain@0.3.7","pypi:langsmith@0.6.4",{"id":99,"slug":284,"dossier":45,"summary":285,"aliases":286,"sourceIds":289,"published":290,"modified":291,"checkedAt":7,"severity":292,"references":295,"versionKeys":310,"packageCount":32,"repositoryCount":32},"ghsa-5chr-fjjv-38qv-5f3dd755","langchain-core allows unauthorized users to read arbitrary files from the host file system",[287,288],"CVE-2024-10940","PYSEC-2026-1517",[99,288],"2025-03-20T12:32:41Z","2026-07-07T17:56:35.905913395Z",[293],{"type":226,"score":294},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[296,298,300,302,304,305,307,308],{"type":233,"url":297},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-10940",{"type":230,"url":299},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F7d481f10102f43559cc57bcad7eba291067939ee",{"type":230,"url":301},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc1e742347f9701aadba8920e4d1f79a636e50b68",{"type":230,"url":303},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fe711034713259ae448981bc0fd1d7a5671499c31",{"type":238,"url":239},{"type":230,"url":306},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fbe1ee1cb-2147-4ff4-a57b-b6045271cf27",{"type":238,"url":243},{"type":233,"url":309},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5chr-fjjv-38qv",[247],{"id":100,"slug":312,"dossier":45,"summary":313,"aliases":314,"sourceIds":317,"published":318,"modified":319,"checkedAt":7,"severity":320,"references":324,"versionKeys":337,"packageCount":32,"repositoryCount":32},"ghsa-6qv9-48xg-fc7f-6f0bc426","LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates",[315,316],"CVE-2025-65106","PYSEC-2026-1518",[100,316],"2025-11-20T17:42:12Z","2026-07-07T17:57:16.939269197Z",[321],{"type":322,"score":323},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[325,327,329,331,333,334,335],{"type":230,"url":326},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",{"type":233,"url":328},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-65106",{"type":230,"url":330},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fc4b6ba254e1a49ed91f2e268e6484011c540542a",{"type":230,"url":332},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Ffa7789d6c21222b85211755d822ef698d3b34e00",{"type":238,"url":239},{"type":238,"url":243},{"type":233,"url":336},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6qv9-48xg-fc7f",[247],{"id":101,"slug":339,"dossier":45,"summary":340,"aliases":341,"sourceIds":344,"published":345,"modified":346,"checkedAt":7,"severity":347,"references":350,"versionKeys":371,"packageCount":32,"repositoryCount":137},"ghsa-926x-3r5x-gfhw-b7d12e65","LangChain has incomplete f-string validation in prompt templates",[342,343],"CVE-2026-40087","PYSEC-2026-2563",[101,343],"2026-04-08T21:51:32Z","2026-07-13T16:42:42.901211235Z",[348],{"type":226,"score":349},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[351,353,355,357,359,361,363,364,366,368,369],{"type":230,"url":352},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",{"type":233,"url":354},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40087",{"type":230,"url":356},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36612",{"type":230,"url":358},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F36613",{"type":230,"url":360},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F6bab0ba3c12328008ddca3e0d54ff5a6151cd27b",{"type":230,"url":362},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Faf2ed47c6f008cdd551f3c0d87db3774c8dfe258",{"type":238,"url":239},{"type":230,"url":365},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.84",{"type":230,"url":367},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.28",{"type":238,"url":243},{"type":233,"url":370},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-926x-3r5x-gfhw",[247,248],{"id":102,"slug":373,"dossier":45,"summary":374,"aliases":375,"sourceIds":378,"published":379,"modified":380,"checkedAt":7,"severity":381,"references":384,"versionKeys":405,"packageCount":32,"repositoryCount":32},"ghsa-c67j-w6g6-q2cm-a4c5c0cf","LangChain serialization injection vulnerability enables secret extraction in dumps\u002Floads APIs",[376,377],"CVE-2025-68664","PYSEC-2026-373",[102,377],"2025-12-23T18:46:13Z","2026-07-02T13:00:05.018724776Z",[382],{"type":226,"score":383},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:L\u002FA:N",[385,387,389,391,393,395,397,398,400,402,403],{"type":230,"url":386},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",{"type":233,"url":388},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68664",{"type":230,"url":390},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34455",{"type":230,"url":392},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fpull\u002F34458",{"type":230,"url":394},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8",{"type":230,"url":396},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fd9ec4c5cc78960abd37da79b0250f5642e6f0ce6",{"type":238,"url":239},{"type":230,"url":399},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D0.3.81",{"type":230,"url":401},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core%3D%3D1.2.5",{"type":238,"url":243},{"type":233,"url":404},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-c67j-w6g6-q2cm",[247],{"id":103,"slug":407,"dossier":45,"summary":408,"aliases":409,"sourceIds":412,"published":413,"modified":414,"checkedAt":7,"severity":415,"references":420,"versionKeys":429,"packageCount":32,"repositoryCount":95},"ghsa-g48c-2wqr-h844-48f35247","LangGraph checkpoint loading has unsafe msgpack deserialization",[410,411],"CVE-2026-28277","PYSEC-2026-83",[103,411],"2026-03-05T20:16:15.677Z","2026-06-06T01:00:08.116125988Z",[416,418],{"type":226,"score":417},"CVSS:3.1\u002FAV:A\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":226,"score":419},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[421,423,425,427],{"type":233,"url":422},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-g48c-2wqr-h844",{"type":233,"url":424},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28277",{"type":238,"url":426},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph",{"type":230,"url":428},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-83.yaml",[430,431,432],"pypi:langgraph@0.1.1","pypi:langgraph@0.3.21","pypi:langgraph@1.0.6",{"id":104,"slug":434,"dossier":45,"summary":435,"aliases":436,"sourceIds":440,"published":441,"modified":442,"checkedAt":7,"severity":443,"references":448,"versionKeys":457,"packageCount":32,"repositoryCount":95},"ghsa-gr75-jv2w-4656-a5b8c61e","LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders",[437,438,439],"CVE-2026-55443","PYSEC-2026-2192","PYSEC-2026-2556",[104,438],"2026-06-16T15:03:14Z","2026-08-07T08:11:57.170704540Z",[444,446],{"type":226,"score":445},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":226,"score":447},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[449,451,453,456],{"type":233,"url":450},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-gr75-jv2w-4656",{"type":233,"url":452},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55443",{"type":454,"url":455},"FIX","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002Fdcaf7795a3e6590af55c3ff7bda6add6355e9ea6",{"type":238,"url":239},[280,281,458],"pypi:langchain@1.2.6",{"id":105,"slug":460,"dossier":45,"summary":461,"aliases":462,"sourceIds":465,"published":466,"modified":467,"checkedAt":7,"severity":468,"references":471,"versionKeys":480,"packageCount":32,"repositoryCount":137},"ghsa-pjwx-r37v-7724-2297a72a","LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists",[463,464],"CVE-2026-44843","PYSEC-2026-2564",[105,464],"2026-05-08T23:07:32Z","2026-07-13T16:42:39.210995356Z",[469],{"type":226,"score":470},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[472,474,476,477,478],{"type":230,"url":473},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",{"type":233,"url":475},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44843",{"type":238,"url":239},{"type":238,"url":243},{"type":233,"url":479},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pjwx-r37v-7724",[247,248],{"id":106,"slug":482,"dossier":45,"summary":483,"aliases":484,"sourceIds":487,"published":488,"modified":489,"checkedAt":7,"severity":490,"references":493,"versionKeys":515,"packageCount":32,"repositoryCount":137},"ghsa-qh6h-p6c9-ff54-caf42ff5","LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions",[485,486],"CVE-2026-34070","PYSEC-2026-2193",[106,486],"2026-03-27T19:45:00Z","2026-07-13T07:26:33.913236655Z",[491],{"type":226,"score":492},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[494,497,499,501,502,504,506,508,510,512],{"type":495,"url":496},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-qh6h-p6c9-ff54",{"type":233,"url":498},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34070",{"type":454,"url":500},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F27add913474e01e33bededf4096151130ba0d47c",{"type":238,"url":239},{"type":233,"url":503},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Freleases\u002Ftag\u002Flangchain-core==1.2.22",{"type":230,"url":505},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34070",{"type":230,"url":507},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34070.json",{"type":233,"url":509},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24766",{"type":233,"url":511},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":513,"url":514},"REPORT","https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2453287",[247,248],{"id":107,"slug":517,"dossier":45,"summary":518,"aliases":519,"sourceIds":522,"published":523,"modified":524,"checkedAt":7,"severity":525,"references":528,"versionKeys":536,"packageCount":32,"repositoryCount":95},"ghsa-r7w7-9xr2-qq2r-7a3a0a91","langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding",[520,521],"CVE-2026-41488","PYSEC-2026-76",[107,521],"2026-04-16T23:00:12Z","2026-06-06T01:15:07.912179267Z",[526],{"type":226,"score":527},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[529,531,533,534],{"type":233,"url":530},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fsecurity\u002Fadvisories\u002FGHSA-r7w7-9xr2-qq2r",{"type":233,"url":532},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41488",{"type":238,"url":239},{"type":230,"url":535},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flangchain-openai\u002FPYSEC-2026-76.yaml",[537,538,539],"pypi:langchain-openai@0.2.8","pypi:langchain-openai@1.1.7","pypi:langchain-openai@1.1.9",{"id":108,"slug":541,"dossier":45,"summary":542,"aliases":543,"sourceIds":547,"published":548,"modified":549,"checkedAt":7,"severity":550,"references":555,"versionKeys":571,"packageCount":137,"repositoryCount":137},"ghsa-w39p-vh2g-g8g5-47880dfe","LangGraph SDK has unsafe URL path construction",[544,545,546],"CVE-2026-48776","PYSEC-2026-2194","PYSEC-2026-2575",[108,545,546],"2026-06-17T10:55:15.113Z","2026-07-21T15:15:50.659527533Z",[551,553],{"type":226,"score":552},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":226,"score":554},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[556,558,560,562,563,565,567,569],{"type":230,"url":557},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Fsecurity\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":233,"url":559},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48776",{"type":233,"url":561},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w39p-vh2g-g8g5",{"type":238,"url":426},{"type":230,"url":564},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flanggraph\u002Freleases\u002Ftag\u002Fsdk%3D%3D0.3.15",{"type":230,"url":566},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph-sdk\u002FPYSEC-2026-2575.yaml",{"type":230,"url":568},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flanggraph\u002FPYSEC-2026-2194.yaml",{"type":238,"url":570},"https:\u002F\u002Fpypi.org\u002Fproject\u002Flanggraph-sdk",[572,430],"pypi:langgraph-sdk@0.3.3",{"id":109,"slug":574,"dossier":45,"summary":131,"aliases":575,"sourceIds":579,"published":580,"modified":581,"checkedAt":7,"severity":582,"references":585,"versionKeys":590,"packageCount":32,"repositoryCount":32},"pysec-2024-323-1dd96856",[576,577,578],"CVE-2024-5998","GHSA-f2jm-rw3h-6phg","PYSEC-2026-1514",[109],"2024-09-17T12:15:02.977Z","2026-07-13T07:26:23.643495355Z",[583],{"type":226,"score":584},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[586,588],{"type":454,"url":587},"https:\u002F\u002Fgithub.com\u002Flangchain-ai\u002Flangchain\u002Fcommit\u002F604dfe2d99246b0c09f047c604f0c63eafba31e7",{"type":495,"url":589},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Ffa3a2753-57c3-4e08-a176-d7a3ffda28fe",[280],1786588640460]