https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 07:34:56 +0000 https://vulnerability.circl.lu/vuln/cve-2026-44843 <p><strong>Affected:</strong> langchain-ai langchain</p> <p>LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=&#34;all&#34;. This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.</p> <p><strong>Affected:</strong> langchain-ai langchain</p> <p>LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=&#34;all&#34;. This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-44843 https://vulnerability.circl.lu/vuln/ghsa-pjwx-r37v-7724 <p><strong>Affected:</strong> PyPI: langchain-core</p> <p>LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call `load()` with `allowed_objects=&#34;all&#34;`. This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments.</p> <p>Applications are exposed only when all of the following are true:</p> <p>1. The application accepts untrusted structured input, such as JSON, from a user or network request. 2. The application does not validate or canonicalize that input into an inert schema before invoking LangChain. 3. Attacker-controlled nested dictionaries or lists are preserved in LangChain run inputs or outputs. 4. The application uses an affected API path that later deserializes that run data.</p> <p>Known affected runtime surfaces include:</p> <p>- `RunnableWithMessageHistory` - `astream_log()` - `astream_events(version=&#34;v1&#34;)`</p> <p>Related unsafe deserialization patterns may also affect applications that explicitly load serialized LangChain prompt or runnable objects from untrusted sources, including shared prompt stores, Hub artifacts with model configuration, or other application-controlled serialization stores.</p> <p>Applications that validate incomin…</p> <p><strong>Affected:</strong> PyPI: langchain-core</p> <p>LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call `load()` with `allowed_objects=&#34;all&#34;`. This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments.</p> <p>Applications are exposed only when all of the following are true:</p> <p>1. The application accepts untrusted structured input, such as JSON, from a user or network request. 2. The application does not validate or canonicalize that input into an inert schema before invoking LangChain. 3. Attacker-controlled nested dictionaries or lists are preserved in LangChain run inputs or outputs. 4. The application uses an affected API path that later deserializes that run data.</p> <p>Known affected runtime surfaces include:</p> <p>- `RunnableWithMessageHistory` - `astream_log()` - `astream_events(version=&#34;v1&#34;)`</p> <p>Related unsafe deserialization patterns may also affect applications that explicitly load serialized LangChain prompt or runnable objects from untrusted sources, including shared prompt stores, Hub artifacts with model configuration, or other application-controlled serialization stores.</p> <p>Applications that validate incomin…</p> https://vulnerability.circl.lu/vuln/ghsa-pjwx-r37v-7724 https://vulnerability.circl.lu/vuln/pysec-2026-2564 <p><strong>Affected:</strong> PyPI: langchain-core</p> <p>LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call `load()` with `allowed_objects=&#34;all&#34;`. This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments.</p> <p>Applications are exposed only when all of the following are true:</p> <p>1. The application accepts untrusted structured input, such as JSON, from a user or network request. 2. The application does not validate or canonicalize that input into an inert schema before invoking LangChain. 3. Attacker-controlled nested dictionaries or lists are preserved in LangChain run inputs or outputs. 4. The application uses an affected API path that later deserializes that run data.</p> <p>Known affected runtime surfaces include:</p> <p>- `RunnableWithMessageHistory` - `astream_log()` - `astream_events(version=&#34;v1&#34;)`</p> <p>Related unsafe deserialization patterns may also affect applications that explicitly load serialized LangChain prompt or runnable objects from untrusted sources, including shared prompt stores, Hub artifacts with model configuration, or other application-controlled serialization stores.</p> <p>Applications that validate incomin…</p> <p><strong>Affected:</strong> PyPI: langchain-core</p> <p>LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call `load()` with `allowed_objects=&#34;all&#34;`. This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments.</p> <p>Applications are exposed only when all of the following are true:</p> <p>1. The application accepts untrusted structured input, such as JSON, from a user or network request. 2. The application does not validate or canonicalize that input into an inert schema before invoking LangChain. 3. Attacker-controlled nested dictionaries or lists are preserved in LangChain run inputs or outputs. 4. The application uses an affected API path that later deserializes that run data.</p> <p>Known affected runtime surfaces include:</p> <p>- `RunnableWithMessageHistory` - `astream_log()` - `astream_events(version=&#34;v1&#34;)`</p> <p>Related unsafe deserialization patterns may also affect applications that explicitly load serialized LangChain prompt or runnable objects from untrusted sources, including shared prompt stores, Hub artifacts with model configuration, or other application-controlled serialization stores.</p> <p>Applications that validate incomin…</p> https://vulnerability.circl.lu/vuln/pysec-2026-2564