{"action":"Upgrade langchain-openai to 1.1.14 or later.","affected":[{"fixed":"1.1.14","introduced":"0"}],"component":"langchain-openai","cve_ids":["CVE-2026-41488"],"ecosystem":"PyPI","epss":0.00239,"exploited":false,"fixed_versions":["1.1.14"],"ghsa_id":"GHSA-r7w7-9xr2-qq2r","id":"tcs_01M5KHDC3GEJKTF2N8F3NF2KEP","modified_at":"2026-05-20T09:19:04.187253Z","published_at":"2026-04-24T21:16:19.637Z","references":["https://osv.dev/vulnerability/PYSEC-2026-76","https://github.com/langchain-ai/langchain/security/advisories/GHSA-r7w7-9xr2-qq2r"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-76","url":"https://osv.dev/vulnerability/PYSEC-2026-76"}],"summary":"LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) val"}