High · published December 24, 2025
⚡ A sneaky serialization injection vulnerability lurks in LangChain's toJSON() method, and it could let attackers play puppet master with your data! Think of it as a restaurant that ignores certain secret ingredient labels when preparing orders — if a customer's dish comes with a hidden ‘lc’ ingredient, the chef might mistakenly prepare it as a specialty dish instead of just a regular meal, causing chaos in the kitchen! An attacker could exploit this flaw to inject malicious data, which might allow them to manipulate or impersonate legitimate LangChain objects. This could lead to unauthorized access or data manipulation, creating a potential nightmare for your application's integrity. Imagine the disruption if a rogue ingredient turns a simple meal into a toxic concoction!
Think of it as a restaurant that ignores certain secret ingredient labels when preparing orders — if a customer's dish comes with a hidden ‘lc’ ingredient, the chef might mistakenly prepare it as a specialty dish instead of just a regular meal, causing chaos in the kitchen! This vulnerability allows attackers to bypass expected serialization processes by injecting user-controlled data with the 'lc' key into the toJSON() method. As a result, it processes this data as a legitimate LangChain object, causing serious security implications during deserialization.
An attacker could exploit this flaw to inject malicious data, which might allow them to manipulate or impersonate legitimate LangChain objects. This could lead to unauthorized access or data manipulation, creating a potential nightmare for your application's integrity. Imagine the disruption if a rogue ingredient turns a simple meal into a toxic concoction! To protect your application, update to @langchain/core versions 0.3.80 or 1.1.8, and langchain versions 0.3.37 or 1.2.3 immediately. Additionally, audit your data handling processes to ensure all user inputs are properly sanitized and validated. Don't let sneaky inputs catch you off guard! You've got this! 🚀 Stay vigilant and secure, and you'll keep your applications safe from unwanted surprises!
| Product | Versions | Fixed in |
|---|---|---|
| langchain/langchain.js | < 0.3.37 | 0.3.37 |
| langchain/langchain.js | ≥ 1.0.0, < 1.2.3 | 1.2.3 |
| langchain/langchain\/core | < 0.3.80 | 0.3.80 |
| langchain/langchain\/core | ≥ 1.0.0, < 1.1.8 | 1.1.8 |