Executive Summary

This vulnerability exists in LangChain versions prior to 0.3.85 and 1.3.3. It involves older runtime code paths that deserialize inputs, outputs, or other payloads using overly broad object allowlists. Specifically, these paths may call a load() function with allowed_objects set to "all", which allows any trusted LangChain-serializable object to be revived.

While this does not enable arbitrary Python object deserialization, it does allow attacker-supplied serialized constructor dictionaries to cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This means an attacker can influence the creation of objects in a way that was not intended, potentially leading to unexpected behavior.

The vulnerability is fixed in LangChain versions 0.3.85 and 1.3.3.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to supply specially crafted serialized data that causes the application to instantiate classes with untrusted constructor arguments. This can lead to unintended behavior within the application, potentially compromising the integrity of the runtime environment.

According to the CVSS score of 8.2, the vulnerability has a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. It can cause high confidentiality impact and low integrity impact, but no availability impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade LangChain to version 0.3.85 or 1.3.3 or later, where the issue with overly broad object allowlists in deserialization paths has been fixed.

Useful 0 Not Useful 0