CVE-2026-44843
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.
How to fix
- langchain langchain0.3.85, 1.3.3 or later
- langchain-core1.3.3, 0.3.85 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| langchain langchain | v < 0.3.85, 1.0.0 ≤ v < 1.3.3 | 0.3.85, 1.3.3 |
| langchain-corePyPI | 1.0.0 ≤ v < 1.3.3, v < 0.3.85 | 1.3.3, 0.3.85 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.