Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

LangChain, Inc. bug bounty programs

langchain.com Updated

LangChain, Inc. runs one public program: a Sorona bug bounty paying up to $4,000.

Top reward
$4,000
Sorona
Programs
1
1 pays cash
Targets in scope
8
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program LangChain, Inc. runs.

  • LangChain

    Sorona · Bug bounty

    Open

    Top reward

    $4,000
    Critical
    $4,000
    High
    $2,000
    Medium
    –
    Low
    –
    Safe harbor
    Partial
    First response
    4 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

8 targets. 7 excluded.

  • https://www.langchain.com

    Web

  • Document loaders, retrievers, vector-store integrations and output parsers, where the framework handles attacker-supplied content most directly

    Products and areas

  • langchain and langchain-core in full: the runnable execution layer, chains and agents, prompt templating, callbacks and tracing, and the serialisation helpers that load and dump objects

    Products and areas

  • langgraph, the stateful agent-graph runtime, with its checkpointers and persistence layer, where graph state crosses a serialisation boundary

    Products and areas

  • LangSmith and langchain.com are in the same program on their own higher tables, as closed-source assets rather than as part of this entry

    Products and areas

  • The declared scope is high-usage LangChain-maintained open-source repositories, roughly 50,000 downloads a day or more, with non-production repositories like langchain-experimental excluded and langchain-community accepted for submission without a bounty

    Products and areas

  • The first-party integration packages that clear the download threshold on their own

    Products and areas

  • Tool-calling and agent-executor paths, meaning anywhere model output reaches something that executes: a shell, an interpreter, a database client or an HTTP caller

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 7

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Automated scanner output, rate limiting, missing headers, self-XSS and open redirects without demonstrated impact

  • Issues that only affect LangChain users without a LangChain-controlled vulnerability, so insecure application code written on top of the framework is not a framework bug

  • Known vulnerable libraries reported without a working proof of concept, and third-party vulnerabilities that need no LangChain-specific mitigation

  • langchain-community for reward purposes: submissions are welcome there but the policy states no bounty is offered

  • langchain-experimental and any repository under roughly 50,000 downloads a day, which are excluded from the paid scope outright

  • Low and Medium severity on the open-source table, which the policy prices at zero, so a finding has to reach High before there is any money in it

  • Prompt injection without demonstrated exploitability, the standalone carve-out that runs through every framework program in this space

Recent changes

Reward and scope changes across every LangChain, Inc. program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in LangChain, Inc. products, from the NVD.

Search NVD
  • CVE-2026-55443 Medium

    LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target o

  • CVE-2026-48776 Medium

    LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Without sanitization of those values, identifiers that contain characters with special mean

  • CVE-2026-48775 Medium

    LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond w

  • CVE-2026-44843 High

    LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all". This does not enable arbitrary Python object deserialization, but it does all

  • CVE-2026-41488 Low

    LangChain is a framework for building agents and LLM-powered applications. Prior to 1.1.14, langchain-openai's _url_to_size() helper (used by get_num_tokens_from_messages for image token counting) validated URLs for SSRF protection and then fetched them in a separate network operation with independent DNS resolution. This left a TOCTOU / DNS rebinding window: an attacker-controlled hostname could

  • CVE-2026-41481 Medium

    LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could

  • CVE-2026-40190 Medium

    LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally vendored lodash set() utility. The baseAssignValue() function only guards against the __proto__ key, but fails to prevent traversal via constructor.prototype. This allows an attacker wh

  • CVE-2026-40087 Medium

    LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate co

About this page

This page gathers every public program listed under langchain.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.