LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NLangchain Core
APPLangchain< 0.3.811.0.0 – 1.2.5 (bez)
Related vulnerabilities
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple f...
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangCha...
LangChain to framework do budowania agentów i aplikacji napędzanych LLM-ami. Przed wersją 1.2.11 metoda ChatOp...
SSRF w LangChain RequestsToolkit — dostęp do sieci wewnętrznej i metadanych chmury
SQL injection przez prompt injection w LangChain GraphCypherQAChain