Update dependency langchain to v1 [SECURITY] by renovate[bot] · Pull Request #103 · 101dotxyz/GPTeam

renovate · 2024-08-06T23:29:12Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
langchain (changelog)	`^0.0.144` → `^1.0.0`

langchain Code Injection vulnerability

CVE-2023-36095 / GHSA-gwqq-6vq7-5j86

More information

Details

An issue in Harrison Chase langchain allows an attacker to execute arbitrary code via the PALChain,from_math_prompt(llm).run in the python exec method.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangChain vulnerable to arbitrary code execution

CVE-2023-38896 / GHSA-92j5-3459-qgp4

More information

Details

An issue in Harrison Chase langchain before version 0.0.236 allows a remote attacker to execute arbitrary code via the from_math_prompt and from_colored_object_prompt functions.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Langchain OS Command Injection vulnerability

CVE-2023-34540 / GHSA-x32c-59v5-h7fg

More information

Details

Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the "releases/tag" reference, a fix is available.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library

CVE-2023-39631 / GHSA-f73w-4m7g-ch9x

More information

Details

An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library.

Patches: Released in v.0.0.308. numexpr dependency is optional for langchain.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

langchain vulnerable to arbitrary code execution

CVE-2023-36281 / GHSA-7gfq-f96f-g85j

More information

Details

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter. This is related to __subclasses__ or a template.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

langchain arbitrary code execution vulnerability

CVE-2023-36258 / GHSA-2qmj-7962-cjq8

More information

Details

An issue in langchain allows an attacker to execute arbitrary code via the PALChain in the python exec method.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Langchain vulnerable to arbitrary code execution

CVE-2023-34541 / GHSA-6643-h7h5-x9wh

More information

Details

Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangChain Server Side Request Forgery vulnerability

CVE-2023-46229 / GHSA-655w-fm8m-m478

More information

Details

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangChain vulnerable to arbitrary code execution

CVE-2023-39659 / GHSA-prgp-w7vf-ch62

More information

Details

An issue in langchain langchain-ai before version 0.0.325 allows a remote attacker to execute arbitrary code via a crafted script to the PythonAstREPLTool._run component.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Langchain Server-Side Request Forgery vulnerability

CVE-2023-32786 / GHSA-6h8p-4hx9-w66c

More information

Details

In Langchain before 0.0.329, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing SSRF and potentially injecting content into downstream tasks.

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

langchain Server-Side Request Forgery vulnerability

CVE-2024-0243 / GHSA-h9j7-5xvc-qhg5

More information

Details

With the following crawler configuration:

from bs4 import BeautifulSoup as Soup

url = "https://example.com"
loader = RecursiveUrlLoader(
    url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text 
)
docs = loader.load()

An attacker in control of the contents of https://example.com could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though prevent_outside=True.

https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51

Resolved in https://github.com/langchain-ai/langchain/pull/15559

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangChain directory traversal vulnerability

CVE-2024-28088 / GHSA-h59x-p739-982c

More information

Details

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure of an API key for a large language model online service, or remote code execution.

Severity

Low

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

langchain vulnerable to path traversal

CVE-2024-3571 / GHSA-rgp8-pm28-3759

More information

Details

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path Traversal') in its LocalFileStore functionality. An attacker can leverage this vulnerability to read or write files anywhere on the filesystem, potentially leading to information disclosure or remote code execution. The issue lies in the handling of file paths in the mset and mget methods, where user-supplied input is not adequately sanitized, allowing directory traversal sequences to reach unintended directories.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangChain vulnerable to arbitrary code execution

CVE-2023-38860 / GHSA-fj32-q626-pjjc

More information

Details

An issue in LangChain prior to v.0.0.247 allows a remote attacker to execute arbitrary code via the prompt parameter.

Severity

CVSS Score: 9.3 / 10 (Critical)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

langchain SQL Injection vulnerability

CVE-2023-36189 / GHSA-7q94-qpjr-xpgm

More information

Details

SQL injection vulnerability in langchain allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Denial of service in langchain-community

CVE-2024-2965 / GHSA-3hjh-jh2h-vrg6

More information

Details

Denial of service in SitemapLoader Document Loader in the langchain-community package, affecting versions below 0.2.5. The parse_sitemap method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality.

Severity

CVSS Score: 4.2 / 10 (Medium)
Vector String: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Langchain SQL Injection vulnerability

CVE-2024-8309 / GHSA-45pg-36p6-83v9

More information

Details

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service (DoS) by deleting all data, breaches in multi-tenant security environments, and data integrity issues. Attackers can create, update, or delete nodes and relationships without proper authorization, extract sensitive data, disrupt services, access data across different tenants, and compromise the integrity of the database.

Severity

CVSS Score: 2.1 / 10 (Low)
Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Langchain SQL Injection vulnerability

CVE-2023-32785 / GHSA-8h5w-f6q9-wg35

More information

Details

In Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

CVE-2026-45134 / GHSA-3644-q5cj-c5c7

More information

Details

Description

The LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest content is controlled by an external party, but prior versions of the SDK did not distinguish this from pulling a prompt within the caller's own organization.

Prompt manifests can intentionally configure a model with a custom base URL, default headers, model name, or other constructor arguments. These are supported features, but they also mean the prompt contents should be treated as executable configuration rather than plain text. A prompt can also include serialized LangChain Runnable or PromptTemplate objects with attacker-controlled constructor kwargs, or secret references that, if secrets_from_env is enabled, read environment variables at deserialization time.
Applications are exposed when all of the following are true:

The application calls pull_prompt or pull_prompt_commit (Python) or pullPrompt or pullPromptCommit (JS/TS) with a public owner/name prompt identifier.
The prompt was published or modified by an untrusted or compromised account.
The application uses the pulled prompt without independently validating its contents.

Applications that only pull prompts from their own organization (referenced by name only, without an owner/ prefix) are not affected by the public prompt trust boundary issue described above. However, same-organization prompts carry their own risk. If an attacker gains write access to the organization (for example, through a leaked LANGSMITH_API_KEY or a compromised team member account), they can push a malicious prompt that is pulled and deserialized without any additional warning.

Impact

An attacker who publishes a malicious prompt to LangSmith Hub may be able to affect applications that pull that prompt by owner/name. If the prompt manifest reaches the SDK's deserialization path, the SDK will instantiate the referenced LangChain objects with the attacker-supplied constructor arguments rather than treating the manifest as inert data.

Realistic impacts include:

Server-side request forgery (SSRF), outbound request redirection, and interception of LLM traffic if a prompt manifest configures an LLM client with an attacker-controlled base_url, proxy, or equivalent endpoint-setting parameter. In typical deployments, redirected requests may include prompt contents, system prompts, retrieved context, model parameters, provider credentials, or other secrets and may disclose them to the attacker-controlled endpoint.
Prompt injection or behavior manipulation if a manifest embeds attacker-controlled system messages, prompt templates, or model parameters that alter the application's behavior.
Additional deserialization risk when include_model=True is passed, because this expands the allowlist to partner integration classes. This is not the default, but it materially increases risk when pulling prompts from outside the caller's organization.

Remediation

The LangSmith SDK now blocks pulling public prompts by owner/name by default. Callers must explicitly opt in by passing dangerously_pull_public_prompt=True (Python) or dangerouslyPullPublicPrompt: true (JS/TS) to acknowledge the trust boundary. This flag should only be set after reviewing and trusting the prompt contents, not merely the publishing account.

Upgrade to LangSmith SDK Python >= 0.8.0 or JS/TS >= 0.6.0.

Guidance for prompt pull methods

The prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) should be used only with trusted prompts. Do not pull public prompts by owner/name from untrusted or unreviewed sources without understanding that the manifest contents will be deserialized and may affect runtime behavior.

When pulling prompts that include model configuration (include_model=True in Python, includeModel: true in JS/TS), the deserialization allowlist expands to include partner integration classes. Because this mode is not the default and is often unnecessary for third-party prompts, prefer the default (false) when pulling prompts from sources outside your organization.

Avoid passing secrets_from_env=True (Python) when pulling untrusted prompts. This parameter allows prompt manifests to read environment variables during deserialization. Only use it with trusted prompts from your own organization.

Same-organization prompts

Prompts pulled from the caller's own organization (referenced by name only, without an owner/ prefix) are not gated by the new dangerously_pull_public_prompt flag, but they are not inherently safe. If an attacker gains write access to the organization (for example, through a leaked LANGSMITH_API_KEY or a compromised team member account), they can push a malicious prompt that redirects LLM traffic to attacker-controlled infrastructure and may disclose any credentials attached to those requests.

The security of same-organization prompts follows a shared responsibility model. The LangSmith SDK enforces trust boundaries for public prompts pulled from external accounts, but it cannot protect against compromised credentials or accounts within the caller's own organization. Securing API keys, managing team member access, and reviewing prompt contents before production deployment are the responsibility of the organization. Organizations should treat prompts as executable configuration and apply the same review and audit practices they would apply to application code.

Credits

First reported by @Moaaz-0x.

Severity

CVSS Score: 7.1 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

CVE-2026-55443 / GHSA-gr75-jv2w-4656

More information

Details

Summary

Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild.

Affected users / systems

You may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected.

Impact

Confidentiality: disclosure of file contents outside the intended root/sandbox.
Authorization: path-prefix bypass can grant access to sibling resources beyond the intended subtree.

Patches / mitigation

The affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable.

Compatibility

Callers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag.

Operational guidance

Confine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control.

LangSmith / hosted deployments note

This issue concerns library components executed by agents.

Severity

CVSS Score: 5.1 / 10 (Medium)
Vector String: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

langchain vulnerable to arbitrary code execution

CVE-2023-36188 / GHSA-57fc-8q82-gfp3

More information

Details

An issue in langchain allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

langchain-ai/langchain (langchain)

`v1.3.9`

`v1.3.8`

`v1.3.7`

`v1.3.6`

`v1.3.4`

`v1.3.2`

`v1.3.1`

`v1.3.0`

`v1.2.18`

`v1.2.17`

`v1.2.16`

`v1.2.15`

`v1.2.14`

`v1.2.13`

`v1.2.12`

`v1.2.11`

`v1.2.10`

`v1.2.9`

`v1.2.8`

`v1.2.7`

`v1.2.6`

`v1.2.4`

`v1.2.3`

`v1.2.2`

`v1.2.1`

`v1.2.0`

`v1.1.3`

`v1.1.2`

`v1.1.1`

`v1.1.0`

`v1.0.8`

`v1.0.7`

`v1.0.6`

`v1.0.5`

`v1.0.4`

`v1.0.3`

`v1.0.2`

`v1.0.0`

`v0.3.27`

`v0.3.26`

`v0.3.25`

`v0.3.24`

`v0.3.23`

`v0.3.22`

`v0.3.21`

`v0.3.20`

`v0.3.19`

`v0.3.18`

`v0.1.16`

Compare Source

What's Changed

openai[patch]: Release 0.1.2 by @baskaryan in #20241
docs: fix external repo partner docs by @efriis in #20238
groq[patch]: Release 0.1.1 by @baskaryan in #20242
experimental[patch]: Release 0.0.57 by @baskaryan in #20243
groq: xfail tool_choice tests by @efriis in #20247
[core]: add tool calls message by @baskaryan in #18947
core[patch]: Pre-release 0.1.42-rc.1 by @baskaryan in #20248
openai[patch]: pre-release 0.1.3-rc.1 by @baskaryan in #20249
anthropic[patch]: Pre-release 0.1.8-rc.1 by @baskaryan in #20250
mistralai[patch]: Pre-release 0.1.2-rc.1 by [@baskaryan](htt

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-09-02T20:55:40Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: poetry.lock

Updating dependencies
Resolving dependencies...

Creating virtualenv 101-ai in /tmp/renovate/repos/github/101dotxyz/GPTeam/.venv

The current project's Python requirement (>=3.9,<3.12) is not compatible with some of the required packages Python requirement:
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0
  - langchain requires Python <4.0.0,>=3.10.0, so it will not be satisfied for Python >=3.9,<3.10.0

Because no versions of langchain match >1.0.0,<1.0.1 || >1.0.1,<1.0.2 || >1.0.2,<1.0.3 || >1.0.3,<1.0.4 || >1.0.4,<1.0.5 || >1.0.5,<1.0.6 || >1.0.6,<1.0.7 || >1.0.7,<1.0.8 || >1.0.8,<1.1.0 || >1.1.0,<1.1.1 || >1.1.1,<1.1.2 || >1.1.2,<1.1.3 || >1.1.3,<1.2.0 || >1.2.0,<1.2.1 || >1.2.1,<1.2.2 || >1.2.2,<1.2.3 || >1.2.3,<1.2.4 || >1.2.4,<1.2.6 || >1.2.6,<1.2.7 || >1.2.7,<1.2.8 || >1.2.8,<1.2.9 || >1.2.9,<1.2.10 || >1.2.10,<1.2.11 || >1.2.11,<1.2.12 || >1.2.12,<1.2.13 || >1.2.13,<1.2.14 || >1.2.14,<1.2.15 || >1.2.15,<1.2.16 || >1.2.16,<1.2.17 || >1.2.17,<1.2.18 || >1.2.18,<1.3.0 || >1.3.0,<1.3.1 || >1.3.1,<1.3.2 || >1.3.2,<1.3.3 || >1.3.3,<1.3.4 || >1.3.4,<1.3.6 || >1.3.6,<1.3.7 || >1.3.7,<1.3.8 || >1.3.8,<1.3.9 || >1.3.9,<1.3.10 || >1.3.10,<1.3.11 || >1.3.11,<1.3.12 || >1.3.12,<1.3.13 || >1.3.13,<1.3.14 || >1.3.14,<1.3.15 || >1.3.15,<1.3.16 || >1.3.16,<1.3.17 || >1.3.17,<1.3.18 || >1.3.18,<1.4.0 || >1.4.0,<2.0.0
 and langchain (1.0.0) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.0.1) requires Python <4.0.0,>=3.10.0
 and langchain (1.0.2) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.0.3) requires Python <4.0.0,>=3.10.0
 and langchain (1.0.4) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.0.5) requires Python <4.0.0,>=3.10.0
 and langchain (1.0.6) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.0.7) requires Python <4.0.0,>=3.10.0
 and langchain (1.0.8) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.1.0) requires Python <4.0.0,>=3.10.0
 and langchain (1.1.1) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.1.2) requires Python <4.0.0,>=3.10.0
 and langchain (1.1.3) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.0) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.1) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.2) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.3) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.4) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.6) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.7) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.8) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.9) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.10) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.11) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.12) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.13) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.14) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.15) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.16) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.2.17) requires Python <4.0.0,>=3.10.0
 and langchain (1.2.18) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.0) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.1) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.2) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.3) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.4) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.6) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.7) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.8) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.9) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.10) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.11) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.12) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.13) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.14) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.15) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.16) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
And because langchain (1.3.17) requires Python <4.0.0,>=3.10.0
 and langchain (1.3.18) requires Python <4.0.0,>=3.10.0, langchain is forbidden.
So, because langchain (1.4.0) requires Python <4.0.0,>=3.10.0
 and 101-ai depends on langchain (^1.0.0), version solving failed.

  • Check your dependencies Python requirement: The Python requirement can be specified via the `python` or `markers` properties
    
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"
    For langchain, a possible solution would be to set the `python` property to ">=3.10.0,<3.12"

    https://python-poetry.org/docs/dependency-specification/#python-restricted-dependencies,
    https://python-poetry.org/docs/dependency-specification/#using-environment-markers

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch 2 times, most recently from 5ba5f7d to 35e2c12 Compare September 20, 2024 12:25

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch 3 times, most recently from c91ca4b to 89cd213 Compare November 4, 2024 17:15

renovate Bot changed the title ~~Update dependency langchain to ^0.1.0 [SECURITY]~~ Update dependency langchain to ^0.2.0 [SECURITY] Nov 12, 2024

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from 89cd213 to cebc720 Compare August 10, 2025 13:04

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from cebc720 to b5bca4c Compare August 19, 2025 13:49

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from b5bca4c to b6d89e6 Compare November 19, 2025 00:35

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from b6d89e6 to 8541669 Compare February 2, 2026 15:06

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY]~~ Update dependency langchain to ^0.2.0 [SECURITY] - autoclosed Mar 19, 2026

renovate Bot closed this Mar 19, 2026

renovate Bot deleted the renovate/pypi-langchain-vulnerability branch March 19, 2026 09:05

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY] - autoclosed~~ Update dependency langchain to ^0.2.0 [SECURITY] Mar 19, 2026

renovate Bot reopened this Mar 19, 2026

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from 8541669 to 84999ad Compare March 19, 2026 14:13

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY]~~ Update dependency langchain to ^0.2.0 [SECURITY] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY] - autoclosed~~ Update dependency langchain to ^0.2.0 [SECURITY] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch 2 times, most recently from 84999ad to 0cc63c6 Compare March 30, 2026 17:58

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY]~~ Update dependency langchain to ^0.2.0 [SECURITY] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY] - autoclosed~~ Update dependency langchain to ^0.2.0 [SECURITY] Apr 28, 2026

renovate Bot reopened this Apr 28, 2026

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from 0cc63c6 to bb2300f Compare April 28, 2026 04:39

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from bb2300f to c5e0705 Compare July 21, 2026 01:41

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch from c5e0705 to 9767865 Compare August 26, 2026 17:04

renovate Bot changed the title ~~Update dependency langchain to ^0.2.0 [SECURITY]~~ Update dependency langchain to v1 [SECURITY] Aug 30, 2026

renovate Bot changed the title ~~Update dependency langchain to v1 [SECURITY]~~ Update dependency langchain to v1 [SECURITY] - autoclosed Sep 4, 2026

renovate Bot closed this Sep 4, 2026

Update dependency langchain to v1 [SECURITY]

654f45a

renovate Bot changed the title ~~Update dependency langchain to v1 [SECURITY] - autoclosed~~ Update dependency langchain to v1 [SECURITY] Sep 4, 2026

renovate Bot reopened this Sep 4, 2026

renovate Bot force-pushed the renovate/pypi-langchain-vulnerability branch 2 times, most recently from 9767865 to 654f45a Compare September 4, 2026 20:30

Navigation Menu

Uh oh!

Update dependency langchain to v1 [SECURITY] - #103

Update dependency langchain to v1 [SECURITY]#103
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-langchain-vulnerability

renovate Bot commented Aug 6, 2024 •

edited

Loading

Uh oh!

renovate Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

langchain Code Injection vulnerability

Details

Severity

References

LangChain vulnerable to arbitrary code execution

Details

Severity

References

Langchain OS Command Injection vulnerability

Details

Severity

References

Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library

Details

Severity

References

langchain vulnerable to arbitrary code execution

Details

Severity

References

langchain arbitrary code execution vulnerability

Details

Severity

References

Langchain vulnerable to arbitrary code execution

Details

Severity

References

LangChain Server Side Request Forgery vulnerability

Details

Severity

References

LangChain vulnerable to arbitrary code execution

Details

Severity

References

Langchain Server-Side Request Forgery vulnerability

Details

Severity

References

langchain Server-Side Request Forgery vulnerability

Details

Severity

References

LangChain directory traversal vulnerability

Details

Severity

References

langchain vulnerable to path traversal

Details

Severity

References

LangChain vulnerable to arbitrary code execution

Details

Severity

References

langchain SQL Injection vulnerability

Details

Severity

References

Denial of service in langchain-community

Details

Severity

References

Langchain SQL Injection vulnerability

Details

Severity

References

Langchain SQL Injection vulnerability

Details

Severity

References

LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning

Details

Description

Impact

renovate Bot commented Aug 6, 2024 •

edited

Loading