Detections
Analytics

SCA: security update for langchain-core (GHSA-926x-3r5x-gfhw)

medium Tenable Self-Hosted Container Security Plugin ID 440098

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28,
 LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt
 template classes accepted f-string templates and formatted them without enforcing the same attribute-
 access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could
 accept templates containing attribute access or indexing expressions and subsequently evaluate those
 expressions during formatting. Second, f-string validation based on parsed top-level field names did not
 reject nested replacement fields inside format specifiers. In this pattern, the nested replacement field
 appears in the format specifier rather than in the top-level field name. As a result, earlier validation
 based on parsed field names did not reject the template even though Python formatting would still attempt
 to resolve the nested expression at runtime. This vulnerability is fixed in 0.3.84 and 1.2.28.
 (CVE-2026-40087)

Solution

Update the langchain-core library and its related packages to version 0.3.84 or later.

See Also

https://github.com/advisories/GHSA-926x-3r5x-gfhw

Plugin Details

Severity: Medium

ID: 440098

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/9/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-40087

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/8/2026

Vulnerability Publication Date: 4/8/2026

Reference Information

CVE: CVE-2026-40087