Threats tagged 'ghsa-c67j-w6g6-q2cm'

A serialization injection vulnerability in LangChain core affects the dumps() and dumpd() functions, which fail to escape user-controlled dictionaries containing 'lc' keys. This allows maliciously crafted serialized data to be deserialized as legitimate LangChain objects, enabling secret extraction from environment variables and instantiation of classes within trusted namespaces with attacker-controlled parameters. The vulnerability impacts applications that deserialize untrusted data or use certain LangChain features relying on vulnerable serialization. A patch is available in versions 1.2.5 and 0.3.81 that fixes the escaping bug and hardens deserialization defaults.