LangChain contains a deserialization flaw in its runtime handling of run inputs, run outputs, and other application-controlled payloads, where the `load()` function is invoked with an overly permissive allowlist that accepts all LangChain-serializable objects. Although this does not enable arbitrary Python object deserialization, it allows any trusted LangChain-serializable constructor dictionary to be revived, which means an attacker can supply a dictionary that will be used to instantiate classes with untrusted constructor arguments. This flaw aligns with CWE‑502 and can potentially lead to code execution or other unintended behavior in the runtime environment.

The affected product is the langchain-ai LangChain framework for Python. Versions earlier than 0.3.85 and earlier than 1.3.3 are vulnerable; all later releases include the fix.

The CVSS score of 8.2 reflects a high severity vulnerability that grants high impact. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is through any application that enables user-provided data to be passed to LangChain’s deserialization routines, which could be local or remote depending on the application architecture. The existing mitigation requires updating the library to a fixed version.