LangChain, a framework for building agents and LLM-powered applications, had insecure deserialization in versions before 0.3.85 and between 1.0.0a1 and 1.3.3. The issue arises from runtime code paths that deserialize inputs using overly broad allowlists, specifically calling load() with allowed_objects="all". While this does not allow arbitrary Python object deserialization, it permits any trusted LangChain-serializable object to be revived, which is broader than necessary. Consequently, attacker-supplied serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments, potentially leading to security risks. The vulnerability is tracked as CVE-2026-44843 and is fixed in versions 0.3.85 and 1.3.3.

The vulnerability allows an attacker to supply malicious serialized data that can cause the LangChain runtime to instantiate trusted objects with untrusted constructor arguments. This can lead to unauthorized information disclosure or manipulation of application behavior. The CVSS score of 8.2 indicates a high impact on confidentiality with limited impact on integrity and no impact on availability. There are no known exploits in the wild as of the published date.

This vulnerability is fixed in LangChain versions 0.3.85 and 1.3.3. Users should upgrade to at least these versions to remediate the issue. Since this is not a cloud service, remediation depends on user action to update the software. Patch status is not explicitly stated in the vendor advisory content, but the fixed versions are clearly identified. Users should verify they are running versions 0.3.85 or later, or 1.3.3 or later, and update accordingly.