{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"0.0.26"}],"component":"langchain-community","cve_ids":["CVE-2024-2057"],"ecosystem":"PyPI","epss":0.00578,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGMWRQKZ49TXHBFBSCVJGQ","modified_at":"2026-05-21T15:00:15.314136284Z","published_at":"2024-03-01T12:15:48.670Z","references":["https://osv.dev/vulnerability/PYSEC-2024-278","https://github.com/bayuncao/vul-cve-16/tree/main/PoC.pkl","https://vuldb.com/?ctiid.255372","https://vuldb.com/?id.255372","https://github.com/langchain-ai/langchain/pull/18695","https://github.com/bayuncao/vul-cve-16"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-278","url":"https://osv.dev/vulnerability/PYSEC-2024-278"}],"summary":"A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/"}