Langchain Core
Monthly
Serialization injection in LangChain JS affects @langchain/core before 0.3.80 and 1.0.0 through 1.1.7, plus langchain before 0.3.37 and 1.0.0 through 1.2.2, where Serializable.toJSON() fails to escape user-controlled objects containing an 'lc' key inside kwargs such as metadata, additional_kwargs, or response_metadata. If an application later deserializes that JSON with load(), injected data can be treated as legitimate LangChain objects, enabling secret extraction when pre-patch secretsFromEnv behavior is in effect or instantiation of classes already exposed through configured import maps. NVD rates this 9.1, but the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because meaningful exploitation requires the specific serialize-then-load workflow and, for the most damaging outcomes, permissive secret or import-map configuration; no public exploit was identified at time of analysis.
Serialization injection in langchain-core (below 0.3.81, and 1.0.0 through 1.2.4) allows unauthenticated attackers to smuggle 'lc'-keyed dictionaries through user-controlled fields such as metadata, additional_kwargs, or response_metadata, so that load()/loads() later treats attacker data as a legitimate LangChain Serializable object instead of plain data, enabling secret extraction and instantiation of trusted-namespace classes whose __init__ performs side effects like file or network operations. Exposure is conditional rather than universal: the application must either serialize untrusted data with dumps()/dumpd() and later deserialize it, use astream_events(version='v1'), or use Runnable.astream_log() - astream_events v2 is explicitly not affected, and class instantiation remains confined to the pre-approved langchain_core, langchain, and langchain_community namespaces. Publicly available exploit code exists and NVD rates the flaw 8.2, though our assessment applies AC:H given the preconditions; CISA KEV does not list it, so this is a genuine but conditional risk rather than a drop-everything emergency, and the fix ships breaking changes that require planning.
Serialization injection in LangChain JS affects @langchain/core before 0.3.80 and 1.0.0 through 1.1.7, plus langchain before 0.3.37 and 1.0.0 through 1.2.2, where Serializable.toJSON() fails to escape user-controlled objects containing an 'lc' key inside kwargs such as metadata, additional_kwargs, or response_metadata. If an application later deserializes that JSON with load(), injected data can be treated as legitimate LangChain objects, enabling secret extraction when pre-patch secretsFromEnv behavior is in effect or instantiation of classes already exposed through configured import maps. NVD rates this 9.1, but the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because meaningful exploitation requires the specific serialize-then-load workflow and, for the most damaging outcomes, permissive secret or import-map configuration; no public exploit was identified at time of analysis.
Serialization injection in langchain-core (below 0.3.81, and 1.0.0 through 1.2.4) allows unauthenticated attackers to smuggle 'lc'-keyed dictionaries through user-controlled fields such as metadata, additional_kwargs, or response_metadata, so that load()/loads() later treats attacker data as a legitimate LangChain Serializable object instead of plain data, enabling secret extraction and instantiation of trusted-namespace classes whose __init__ performs side effects like file or network operations. Exposure is conditional rather than universal: the application must either serialize untrusted data with dumps()/dumpd() and later deserialize it, use astream_events(version='v1'), or use Runnable.astream_log() - astream_events v2 is explicitly not affected, and class instantiation remains confined to the pre-approved langchain_core, langchain, and langchain_community namespaces. Publicly available exploit code exists and NVD rates the flaw 8.2, though our assessment applies AC:H given the preconditions; CISA KEV does not list it, so this is a genuine but conditional risk rather than a drop-everything emergency, and the fix ships breaking changes that require planning.