What’s Vulnerable › Vulnerabilities
CVE-2026-44843: LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
- Severity: high (CVSS 8.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-26 · updated 2026-07-24
- Weakness: CWE-502
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.
Affected products
- langchain-ai/langchain: before 0.3.85; from 1.0.0 before 1.3.3 — fixed in 0.3.85, 1.3.3
How to fix
Upgrade to a fixed version: langchain-ai/langchain 0.3.85, 1.3.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44843 or the next vulnerability affects your stack