Описание
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.
A flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially crafted LangChain serialized constructor dictionaries, leading to the instantiation of classes with untrusted arguments. This can result in the disclosure of sensitive information and potential partial compromise of data integrity.
Отчет
This Important vulnerability in LangChain allows a remote attacker to achieve information disclosure and partial data integrity compromise. The flaw arises from overly broad object allowlists in older runtime code paths, which can deserialize attacker-controlled payloads and instantiate classes with untrusted arguments. Red Hat products integrating LangChain are affected if they process untrusted structured input and utilize deprecated APIs such as RunnableWithMessageHistory, astream_log(), or astream_events(version="v1"), potentially leading to prompt injection or sensitive data exposure.
Меры по смягчению последствий
To mitigate this issue, applications using LangChain should avoid passing untrusted structured input directly to load() or loads() functions. Instead, ensure all incoming untrusted data is validated and canonicalized into an inert schema before being processed by LangChain. Additionally, migrate away from deprecated LangChain APIs, including RunnableWithMessageHistory, astream_log(), and astream_events(version="v1"), as these older code paths are more susceptible to insecure deserialization.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Affected | ||
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/lightspeed-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-chatbot-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-rhel8 | Will not fix | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-cuda-rhel9 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-gaudi-rhel9 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/bootc-rocm-rhel9 | Affected | ||
| Red Hat Enterprise Linux AI (RHEL AI) 3 | rhelai3/disk-image-cuda-rhel9 | Affected | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-autorag-rhel9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
8.2 High
CVSS3
Связанные уязвимости
LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.85 and 1.3.3, LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="all". This does not enable arbitrary Python object deserialization, but it does allow any trusted LangChain-serializable object to be revived, which is broader than these runtime paths require. As a result, attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments. This vulnerability is fixed in 0.3.85 and 1.3.3.
LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
EPSS
8.2 High
CVSS3