langchain

Typescript bindings for langchain

Latest 1.5.15

NPM

88%

Total Score

healthy

Healthy: active releases and maintenance outweigh a few workflow security-hygiene concerns.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All 22 workflows were analyzed successfully, all 90 action references are pinned, and 18 workflows use read-only permissions. High-confidence template-injection findings and inherited secrets are hygiene concerns, while trusted-publishing usage warrants caution; no untrusted checkout or script-injection sink was found.

Vulnerabilities

Title	Versions	Severity
CVE-2024-7774 langchain is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 0.2.19.	0.0.0 - 0.2.19	Medium
AIKIDO-2024-10244 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. langchain is vulnerable to Insertion of Sensitive Information into Log File in versions 0.1.0 - 0.2.17.	0.1.0 - 0.2.17	Low

Package versions

Maintainers

hntrl

lc-oss-admin

Direct Dependencies

Dependency	Last Release	Score
zod Version ^3.25.76 \|\| ^4	—	—
langsmith Version >=0.5.0 <1.0.0	—	—
@langchain/langgraph Version ^1.4.13	—	—
@langchain/langgraph-checkpoint Version ^1.1.5	—	—