{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:4239c478-f31f-5530-88b9-3ed29a69e118",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "langchain-core",
      "purl": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare",
      "type": "library",
      "bom-ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare",
      "version": "0.3.83.post3+tuxcare",
      "pedigree": {
        "ancestors": [
          {
            "name": "langchain-core",
            "purl": "pkg:pypi/langchain-core@0.3.83",
            "type": "library",
            "version": "0.3.83"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2024-10940",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:d11e7bf8-d546-535c-b477-bd6addce109b",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-10940 does not affect version 0.3.83.post3+tuxcare of langchain-core. not_affected \u2014 The target langchain-core version 0.3.83.post2+tuxcare is not affected by CVE-2024-10940. The vulnerability allowed arbitrary file reading through ImagePromptTemplate and ChatPromptTemplate by accepting user-controlled 'path' parameters. The upstream vendor (langchain-ai) fixed this in version 0.3.15 by removing the path loading functionality entirely. Commit c1e742347f (authored by Bagatur fro...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-1455",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:6910008f-0c3f-54b1-a302-ae02938936a7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-1455 does not affect version 0.3.83.post3+tuxcare of langchain-core. not_affected \u2014 CVE-2024-1455 addresses XML entity expansion vulnerabilities in LangChain's XMLOutputParser when using Python's standard library xml.etree module. The fix (commit e8339b1d83 by Eugene Yurtsev, March 2024) added defusedxml support and made it the default parser, replacing the vulnerable direct use of ET.XMLPullParser. This upstream fix was already present in release 0.3.83 before any TuxCare mod...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-28088",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:991bdb64-8962-5ea0-a7c4-f923a049afdb",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-28088 does not affect version 0.3.83.post3+tuxcare of langchain-core. not_affected \u2014 CVE-2024-28088 describes a directory traversal vulnerability in LangChain's load_chain function that allowed escaping the intended hwchase17/langchain-hub GitHub repository boundary via ../ sequences in lc:// hub paths. The vulnerability was fixed by upstream vendor commit e1924b3e93 (March 5, 2024) by Erick Friis, which added URL validation and deprecated the old hub loading. The current versi...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2025-65106",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:cf403d76-3089-5e21-aea5-5e4ad44d82b6",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-65106 does not affect version 0.3.83.post3+tuxcare of langchain-core. already_fixed \u2014 target already contains the fix / no backport applicable"
      }
    },
    {
      "id": "CVE-2025-68664",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:27114456-29da-5602-9d4a-d4557a9bb93e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-68664 does not affect version 0.3.83.post3+tuxcare of langchain-core. not_affected \u2014 The target repository (langchain-core 0.3.83) is NOT affected by CVE-2025-68664. The vulnerability involved unescaped user-controlled dictionaries with 'lc' keys in serialization functions, allowing attackers to inject malicious LangChain object structures to extract environment secrets or instantiate arbitrary classes. The fix (commit d9ec4c5cc7) adds comprehensive escaping logic that wraps an...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-26013",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a9f56fc8-5f89-5bd1-83a6-1e5726545ef8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-26013 affects version 0.3.83.post3+tuxcare of langchain-core."
      }
    },
    {
      "id": "CVE-2026-34070",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:a1de7678-6532-5854-bf90-e44f9eb4d8b4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-34070 is fixed in version 0.3.83.post3+tuxcare of langchain-core."
      }
    },
    {
      "id": "CVE-2026-40087",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:32d0ee7e-c0c3-5db2-82c7-41da845e9a5c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40087 is fixed in version 0.3.83.post3+tuxcare of langchain-core."
      }
    },
    {
      "id": "CVE-2026-44843",
      "affects": [
        {
          "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
        }
      ],
      "bom-ref": "urn:uuid:2315150b-1d87-5b3e-81b2-3e1368211b8f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44843 is fixed in version 0.3.83.post3+tuxcare of langchain-core."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:pypi/langchain-core@0.3.83.post3+tuxcare"
    }
  ]
}