{"data":{"id":"a39669b8-ec7f-43d1-a668-57adf4667752","title":"GHSA-pjwx-r37v-7724: LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists","summary":"LangChain's older runtime code paths deserialize run inputs, run outputs, and other application-controlled payloads using overly broad allowlists, sometimes calling `load()` with `allowed_objects=\"all\"`. Attacker-supplied LangChain serialized constructor dictionaries can therefore cause trusted classes to be instantiated with untrusted constructor arguments, when the application accepts untrusted structured input and preserves it in run data. A related `_is_lc_secret` validation bypass in the serialization layer provides an additional path to the same revival logic.","solution":"LangChain will deprecate `RunnableWithMessageHistory`, `astream_log()` and `astream_events(version=\"v1\")`, and applications should migrate to the currently recommended APIs, including the `stream` API. LangChain will also update `load()` and `loads()` to tighten deserialization so broad object revival is not applied implicitly to untrusted or application-controlled payloads.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-pjwx-r37v-7724","publishedAt":"2026-05-08T23:07:32.000Z","cveId":"CVE-2026-44843","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["jailbreak","other"],"issueType":"vulnerability","affectedPackages":["langchain-core@<= 0.3.84 (fixed: 0.3.85)","langchain-core@>= 1.0.0, <= 1.3.2 (fixed: 1.3.3)"],"affectedPackageNames":["langchain-core"],"affectedPackageRefs":["pypi:langchain-core"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","RunnableWithMessageHistory","astream_log()","astream_events(version=\"v1\")"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00406,"epssCheckedAt":"2026-11-08T06:09:28.210Z","kevDateAdded":null,"advisoryAliases":["GHSA-pjwx-r37v-7724"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-08T23:07:32.000Z","fixReleasedAt":"2026-05-05T19:02:34.520Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:36:37.167Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0054"],"fixes":[{"ecosystem":"pypi","name":"langchain-core","fixedVersion":"0.3.85","matchedVersion":"0.3.85","fixReleasedAt":"2026-05-05T20:43:19.294Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:37.020Z"},{"ecosystem":"pypi","name":"langchain-core","fixedVersion":"1.3.3","matchedVersion":"1.3.3","fixReleasedAt":"2026-05-05T19:02:34.520Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:37.020Z"}]}}