Executive Summary

This vulnerability is a serialization injection issue in LangChain JS's toJSON() method. The method did not properly escape objects with 'lc' keys when serializing free-form data in keyword arguments. Since the 'lc' key is used internally by LangChain to mark serialized objects, user-controlled data containing this key structure could be treated as legitimate LangChain objects during deserialization instead of plain user data, potentially allowing injection of malicious serialized objects.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to inject malicious serialized objects during deserialization, which could lead to unauthorized actions or compromise of the application using LangChain. The CVSS score of 8.6 indicates a high severity with network attack vector and no user interaction required, potentially leading to high confidentiality impact.

Useful 0 Not Useful 0

Mitigation Strategies

Update @langchain/core to version 0.3.80 or 1.1.8 or later, and update langchain to version 0.3.37 or 1.2.3 or later, as these versions contain the patch that fixes the serialization injection vulnerability in the toJSON() method.

Useful 0 Not Useful 0