PyPI/langchain-core CVE-2026-26013: low 3.7, EPSS 0.43%
LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
Action: Upgrade langchain-core to 1.2.11 or later.
pip install langchain-core==1.2.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.2.11 | - |
Fixed versions
| 1.2.11 |
Sources
- osv: GHSA-2g6r-c272-w58r
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-2g6r-c272-w58r
- https://nvd.nist.gov/vuln/detail/CVE-2026-26013
- https://github.com/langchain-ai/langchain/commit/2b4b1dc29a833d4053deba4c2b77a3848c834565
- https://github.com/langchain-ai/langchain
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.11
CVE-2026-26013 · published · modified · JSON