GitHub Advisory: LangChain runtime deserialization paths used overly broad allowlists

Source Summary

What It Contains

GitHub advisory GHSA-pjwx-r37v-7724 describes CVE-2026-44843, where affected LangChain runtime paths could deserialize application-controlled run data with overly broad object allowlists.

Extracted Claims

• The advisory covers langchain-core versions <= 0.3.84 and versions >= 1.0.0, <= 1.3.2.
• Patched versions are 0.3.85 and 1.3.3.
• Older runtime code paths may deserialize run inputs, run outputs, or other application-controlled payloads using load() with allowed_objects="all".
• The advisory says this does not enable arbitrary Python object deserialization, but can revive trusted LangChain-serializable objects more broadly than the affected runtime paths require.
• Attacker-supplied LangChain serialized constructor dictionaries may cause trusted runtime paths to instantiate classes with untrusted constructor arguments.
• Exposed applications must accept untrusted structured input, fail to canonicalize it into an inert schema, preserve attacker-controlled nested structures in run data, and use an affected API path that later deserializes that run data.
• Known affected runtime surfaces include RunnableWithMessageHistory, astream_log(), and astream_events(version="v1").
• NVD published CVE-2026-44843 metadata on 2026-05-26 with CWE-502 and CVSS 3.1 base score 8.2.

Evidence Quality

Primary GitHub Security Advisory with GHSA and CVE identifiers, affected and patched version ranges, conditions required for exposure, and named runtime surfaces. The risk depends on application data flow, so operators should verify whether untrusted structured input can reach affected run-history or event deserialization paths.

Armorer Relevance

The advisory is relevant to Armorer because it shows that agent framework runtime data, not only model prompts or explicit tool calls, can become a security boundary. Armorer could use this pattern for package-version inventory, health checks around untrusted structured input flowing into run histories and event streams, container isolation for LangChain apps, runtime monitoring for abnormal behavior, and credential-scope review.

Follow-Up

• Track downstream agent frameworks, templates, or container images that embed vulnerable langchain-core versions.
• Consider an Armorer health check for vulnerable LangChain versions and untrusted structured inputs flowing into RunnableWithMessageHistory, astream_log(), or astream_events(version="v1").
• Encourage operators to upgrade and review whether run data is canonicalized into inert schemas before any framework deserialization boundary.