Software
Breachwright← Back to the database
critical · 9.3Maintainer reviewedAASD-2025-0007
LangChain serialization injection permits secret extraction and trusted-class instantiation
LangChain Core before 0.3.81 and versions 1.0.0 through 1.2.4 failed to escape user-controlled dictionaries containing internal `lc` markers during serialization. Later deserialization could interpret those dictionaries as trusted LangChain objects, exposing environment secrets or triggering side effects in allowlisted classes.
Prerequisites
- An affected application serializes user- or model-controlled dictionaries and later deserializes them, or directly loads untrusted serialized data
- Secret extraction additionally requires environment-secret loading to be enabled in the vulnerable deserialization path
Potential impact
- Extraction of environment-variable secrets available to the application process
- Instantiation of allowlisted LangChain classes with attacker-controlled parameters and resulting network, file, or other constructor side effects
Mitigations
- Upgrade langchain-core to version 0.3.81 or 1.2.5 or later on the applicable release line
- Keep secrets_from_env disabled and use the narrowest explicit allowed_objects allowlist
- Do not deserialize untrusted documents, model response metadata, cache entries, or remote manifests
- Use astream_events version 2 and isolate agent-process credentials from retrievable application data
Public sources
Research note
Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-28.