langchain_core-1.5.2-py3-none-any.whl: 1 vulnerabilities (highest severity is: 7.4)

Open Beginner friendly
  • Is something wrong?
#520 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start with examples/langchain/bedrock-financial-assistant/pyproject.toml and identify the langchain-core version that brings in the vulnerable certifi dependency through langsmith and httpx. Upgrade langchain-core to 1.5.3 as suggested, then verify the resolved certifi version is 2026.10.19 or later and the vulnerability is cleared.

Written by the indexing model from the issue text.

Description

Mend: dependency security vulnerability untriaged
Vulnerable Library - langchain_core-1.5.2-py3-none-any.whl

Sample Path to Dependency File: /examples/langchain/bedrock-financial-assistant/pyproject.toml

Path to vulnerable library: /examples/langchain/bedrock-financial-assistant/.venv/lib/python3.12/site-packages/certifi-2026.1.4.dist-info

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (langchain_core version) Remediation Possible**
WS-2026-0133 High 7.4 certifi-2026.1.4-py3-none-any.whl Transitive 1.5.3 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2026-0133
Vulnerable Library - certifi-2026.1.4-py3-none-any.whl

Python package for providing Mozilla's CA Bundle.

Library home page: https://files.pythonhosted.org/packages/e6/ad/3cc14f097111b4de0040c83a525973216457bbeeb63739ef1ed275c1c021/certifi-2026.1.4-py3-none-any.whl

Sample Path to Dependency File: /examples/langchain/bedrock-financial-assistant/pyproject.toml

Path to vulnerable library: /examples/langchain/bedrock-financial-assistant/.venv/lib/python3.12/site-packages/certifi-2026.1.4.dist-info

Dependency Hierarchy:

  • langchain_core-1.5.2-py3-none-any.whl (Root Library)
    • langsmith-0.8.18-py3-none-any.whl
      • httpx-0.28.1-py3-none-any.whl
        • ❌ certifi-2026.1.4-py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 85a64cace68e869559113ce87327c43bb32dd24a

Found in base branch: main

Vulnerability Details

certifi 2019.03.09 through 2026.07.22 ships the "emSign ECC Root CA - G3" root certificate in its CA bundle (certifi/cacert.pem). Intermediates under this root were revoked for key compromise (cACompromise), so certificates issued with the compromised CA keys are trusted by applications that use certifi, enabling man-in-the-middle attacks. Fixed in 2026.10.18, which removed the root; 2026.10.19 restored the unaffected emSign roots and keeps G3 removed.

Publish Date: 2026-10-20

URL: WS-2026-0133

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-10-20

Fix Resolution (certifi): 2026.10.19

Direct dependency fix Resolution (langchain-core): 1.5.3

⛑️ Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

Dominant language
JavaScript
Stars
44
Forks
41
Avg merge
1d 9h
Merged PRs (30d)
17

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from opensearch-project/observability-stack

All issues in opensearch-project/observability-stack

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.