{"action":"Upgrade langchain-core to 0.1.53 or later.","affected":[{"fixed":"0.1.53","introduced":"0.1.17"},{"fixed":"0.2.43","introduced":"0.2.0"},{"fixed":"0.3.15","introduced":"0.3.0"}],"component":"langchain-core","cve_ids":["CVE-2024-10940"],"ecosystem":"PyPI","epss":0.00396,"exploited":false,"fixed_versions":["0.1.53","0.2.43","0.3.15"],"ghsa_id":"GHSA-5chr-fjjv-38qv","id":"tcs_01M5KGT2VABMCRAWQBFBEKW5MF","modified_at":"2026-07-07T17:46:47.900377345Z","published_at":"2026-07-07T14:34:52.475462Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1517","https://nvd.nist.gov/vuln/detail/CVE-2024-10940","https://github.com/langchain-ai/langchain/commit/7d481f10102f43559cc57bcad7eba291067939ee","https://github.com/langchain-ai/langchain/commit/c1e742347f9701aadba8920e4d1f79a636e50b68","https://github.com/langchain-ai/langchain/commit/e711034713259ae448981bc0fd1d7a5671499c31","https://github.com/langchain-ai/langchain","https://huntr.com/bounties/be1ee1cb-2147-4ff4-a57b-b6045271cf27","https://pypi.org/project/langchain-core","https://github.com/advisories/GHSA-5chr-fjjv-38qv"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-1517","url":"https://osv.dev/vulnerability/PYSEC-2026-1517"}],"summary":"langchain-core allows unauthorized users to read arbitrary files from the host file system"}