langchain

Typescript bindings for langchain

Latest 1.5.16

NPM

84%

Total Score

healthy

Active, well-supported project with workflow credential and template-handling concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 22 workflows were analyzed and all 90 action references are pinned, with no untrusted checkout or script-injection findings. However, high-confidence template-injection findings, inherited secrets in the release workflow, and trusted-publishing findings create CI hygiene and credential-handling concerns; top-level write permissions affect four workflows but are not paired with an untrusted sink here.

Vulnerabilities

Title	Versions	Severity
CVE-2024-7774 langchain is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 0.2.19.	0.0.0 - 0.2.19	Medium
AIKIDO-2024-10244 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. langchain is vulnerable to Insertion of Sensitive Information into Log File in versions 0.1.0 - 0.2.17.	0.1.0 - 0.2.17	Low

Package versions

Maintainers

hntrl

lc-oss-admin

Direct Dependencies

Dependency	Last Release	Score
zod Version ^3.25.76 \|\| ^4	—	—
langsmith Version >=0.5.0 <1.0.0	—	—
@langchain/langgraph Version ^1.4.18	—	—
@langchain/langgraph-checkpoint Version ^1.1.5	—	—