LangChain

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Severe / Critical, open-source tier (the $5,000-$10,000+ band is the separate LangSmith commercial table) │ $2,000 - $4,000 │ $2,500 - $5,000 High, open-source tier │ $500 - $2,000 │ $625 - $2,500 Low / Medium, open-source tier: the policy states no bounty │ $0 │ $0 Submit a vulnerability CVE history 9 Last 12 months 45 Lifetime Code execution 35 % Injection 25 % Info disclosure 20 % Parsing/validation 15 % Latest advisories Loading the feed Overview LangChain is the default orchestration layer for a very large share of production LLM applications, and its footprint is much larger than its star count suggests because most consumption is transitive: langchain and langchain-core together run to tens of millions of PyPI downloads a month, and langchain-core sits underneath most of the Python agent ecosystem, including LangGraph, the LangSmith SDKs and a long tail of vendor integration packages. Deployment is overwhelmingly server-side, inside enterprise application backends, which is exactly where a deserialisation bug or a tool-execution path that model output can steer converts into remote code execution on infrastructure holding customer data: code execution is 35 percent of this project's advisory history, and langchain-core is the hot surface right now with fourteen advisories in the last twelve months. LangChain, Inc. runs the bounty itself out of the repository's security policy rather than through a platform, and the open-source table pays $2,000 to $4,000 for a Severe or Critical finding, $500 to $2,000 for a High, and nothing at all for Low or Medium. Read the tables carefully before you size the work: the $5,000 to $10,000+ band that appears on the same page is the LangSmith commercial-platform scale, and LangSmith is not open source. sorona.xyz adds 1.25× on top of whatever LangChain awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope The declared scope is high-usage LangChain-maintained open-source repositories, roughly 50,000 downloads a day or more, with non-production repositories like langchain-experimental excluded and langchain-community accepted for submission without a bounty langchain and langchain-core in full: the runnable execution layer, chains and agents, prompt templating, callbacks and tracing, and the serialisation helpers that load and dump objects langgraph , the stateful agent-graph runtime, with its checkpointers and persistence layer, where graph state crosses a serialisation boundary Tool-calling and agent-executor paths, meaning anywhere model output reaches something that executes: a shell, an interpreter, a database client or an HTTP caller Document loaders, retrievers, vector-store integrations and output parsers, where the framework handles attacker-supplied content most directly The first-party integration packages that clear the download threshold on their own LangSmith and langchain.com are in the same program on their own higher tables, as closed-source assets rather than as part of this entry Out of scope Prompt injection without demonstrated exploitability, the standalone carve-out that runs through every framework program in this space Known vulnerable libraries reported without a working proof of concept, and third-party vulnerabilities that need no LangChain-specific mitigation Issues that only affect LangChain users without a LangChain-controlled vulnerability, so insecure application code written on top of the framework is not a framework bug langchain-experimental and any repository under roughly 50,000 downloads a day, which are excluded from the paid scope outright langchain-community for reward purposes: submissions are welcome there but the policy states no bounty is offered Low and Medium severity on the open-source table, which the policy prices at zero, so a finding has to reach High before there is any money in it Automated scanner output, rate limiting, missing headers, self-XSS and open redirects without demonstrated impact Most-valued findings A reliable path to remote code execution reachable from untrusted input across many deployments: a deserialisation defect in a loader or a checkpointer, or an executor that model output can steer into a shell. This is the Severe/Critical band, the only one that reaches $4,000, and the policy names RCE as its own example. Exposure of environment secrets or provider API keys out of a running chain, which the policy places in the same top band and which turns one framework bug into credential theft across every tenant Injection that survives to a sink with real consequences, whether SQL, command, template or SSRF through a retriever or a tool, as distinct from prompt injection that only changes model output and is explicitly out of scope Defects in langchain-core specifically, which carries fourteen advisories in the last twelve months and sits transitively under most of the Python agent ecosystem, so one bug there reaches far beyond direct users Cross-session or cross-tenant data exposure through LangGraph's persistence layer, where one user's checkpointed graph state becomes readable to another Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repository has to be a high-usage LangChain-maintained one, roughly 50,000 downloads a day or more; langchain , langchain-core and langgraph all clear that comfortably and smaller packages do not langchain-community submissions are accepted but explicitly earn no bounty, because the project treats it as community-maintained Prompt injection with no demonstrated exploitability is out of scope: show the injected output actually reaching an executor, a secret or a filesystem, not just that it changes the model's behaviour A known-vulnerable dependency without a working proof of concept does not count, and a third-party vulnerability is out of scope unless LangChain-specific mitigations are required Low and Medium severity pay nothing on the open-source table, so a finding has to reach High before there is any money in it at all Payment is by wire or Goody and availability varies by country, which is worth checking before you commit time Disclosure Coordinated directly with LangChain, which states an initial response within four business days and initial triage within fifteen. The policy tells you not to disclose publicly without their explicit written permission, so the timing is theirs; sorona.xyz holds the finding until LangChain has shipped a fix. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability