Vulnerability · Published May 26, 2026 · Assigned by GitHub_M
CVE-2026-44843LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
High 8.2
In plain English
A high-severity unsafe deserialization in langchain from langchain-ai. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | langchain-core | 1.3.3 | GHSA-pjwx-r37v-7724 |
| PyPI | langchain-core | 0.3.85 | GHSA-pjwx-r37v-7724 |
| PyPI | langchain-core | 0.3.85, 1.3.3 | PYSEC-2026-2564 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| langchain-ai | langchain | < 0.3.85>= 1.0.0a1, < 1.3.3 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N