CVE-2026-44843

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44843", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T21:21:48.352Z", "datePublished": "2026-05-26T19:47:35.328Z", "dateUpdated": "2026-05-27T14:07:03.564Z"}, "containers": {"cna": {"title": "LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists", "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "lang": "en", "description": "CWE-502: Deserialization of Untrusted Data", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724"}], "affected": [{"vendor": "langchain-ai", "product": "langchain", "versions": [{"version": "< 0.3.85", "status": "affected"}, {"version": ">= 1.0.0a1, < 1.3.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T19:47:35.328Z"}, "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=\"all\". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3."}], "source": {"advisory": "GHSA-pjwx-r37v-7724", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T14:06:50.805026Z", "id": "CVE-2026-44843", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:07:03.564Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44843", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T14:06:50.805026Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:06:57.825Z"}}], "cna": {"title": "LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists", "source": {"advisory": "GHSA-pjwx-r37v-7724", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "langchain-ai", "product": "langchain", "versions": [{"status": "affected", "version": "< 0.3.85"}, {"status": "affected", "version": ">= 1.0.0a1, < 1.3.3"}]}], "references": [{"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724", "name": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=\"all\". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502: Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-26T19:47:35.328Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44843", "state": "PUBLISHED", "dateUpdated": "2026-05-27T14:07:03.564Z", "dateReserved": "2026-05-07T21:21:48.352Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-26T19:47:35.328Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "langchain", "vendor": "langchain-ai", "versions": [{"status": "affected", "version": "< 0.3.85"}, {"status": "affected", "version": ">= 1.0.0a1, < 1.3.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*", "matchCriteriaId": "F51597F7-5582-4105-8A1A-957ED4394741", "versionEndExcluding": "0.3.85", "vulnerable": true}, {"criteria": "cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADE91EFB-2D03-4922-8089-5B34BD1DC348", "versionEndExcluding": "1.3.3", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects=\"all\". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3."}, {"lang": "es", "value": "LangChain es un framework para construir agentes y aplicaciones impulsadas por LLM. Antes de 0.3.85 y 1.3.3, LangChain contiene rutas de c\u00f3digo de tiempo de ejecuci\u00f3n m\u00e1s antiguas que deserializan entradas de ejecuci\u00f3n, salidas de ejecuci\u00f3n u otras cargas \u00fatiles controladas por la aplicaci\u00f3n utilizando listas de permitidos de objetos excesivamente amplias. Estas rutas pueden llamar a load() con allowed_objects='all'. Esto no habilita la deserializaci\u00f3n arbitraria de objetos Python, pero s\u00ed permite que cualquier objeto LangChain serializable de confianza sea revivido, lo cual es m\u00e1s amplio de lo que requieren estas rutas de tiempo de ejecuci\u00f3n. Como resultado, los diccionarios de constructor serializados de LangChain suministrados por el atacante pueden hacer que las rutas de tiempo de ejecuci\u00f3n de confianza instancien clases con argumentos de constructor no confiables. Esta vulnerabilidad est\u00e1 corregida en 0.3.85 y 1.3.3."}], "id": "CVE-2026-44843", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44843", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T14:06:50.805026Z", "version": "2.0.3"}}]}, "published": "2026-05-26T21:16:39.003", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.3.85)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0a1,1.3.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "langchain", "source": "cna", "vendor": "langchain-ai"}, "product": "langchain", "vendor": "langchain-ai"}], "created": "2026-05-26T22:00:15.766522+00:00", "updated": "2026-05-27T00:30:20.172100+00:00", "vendors": ["langchain-ai", "langchain-ai$PRODUCT$langchain"]}