Database/AI/ML frameworks & serving
LangChain Core: unescaped 'lc' keys let user data be revived as LangChain objects on load
Impact
LangChain marks its own serialized objects with an 'lc' key, and dumps()/dumpd() did not escape that key when serializing free-form dictionaries. User-controlled data carrying the right key structure is therefore treated as a genuine LangChain object when the payload is deserialized, not as plain data. Where an agent persists messages, tool results or checkpoints and reloads them later, an attacker who can plant a dictionary in that path influences what gets reconstructed on the serving host - the record scores it as high confidentiality with some integrity impact. Distinct from the prompt-template injection in CVE-2025-65106: the flaw is in the serialization layer, with its own fix and versions.
Who can reach it
Network. Any user whose input reaches a dictionary that the application serializes with dumps()/dumpd() and later deserializes. No authentication is required by the record (PR:N); the effect depends on the application round-tripping the data.
What to do
Upgrade langchain-core to 0.3.81 or 1.2.5 and restart the application and any workers that load persisted state. Treat already-stored serialized blobs as untrusted - the fix escapes new writes, it does not sanitize data written before the upgrade.
References
Related entries
- vLLM: out-of-vocabulary stop_token_ids kill EngineCore and take the model server down until restartCVE-2026-100652 · vLLM (Rust HTTP/gRPC frontend, stop_token_ids validation)High
- SGLang: a one-character request id lets any client abort every other client's in-flight generationCVE-2026-112266 · SGLang (tokenizer_manager request-id abort handling)High
- GitLab AI Gateway: crafted model metadata redirects model requests and discloses Vertex or Bedrock credentialsCVE-2026-19889 · GitLab AI Gateway (Duo Agent Platform model metadata handling)High
- Docker Model Runner (vllm-metal backend): `trust_remote_code=True` set unconditionally, no sandboxCVE-2026-5817 · Docker Model Runner (vllm-metal backend)High
- GitLab AI Gateway: crafted inline flow config overrides the HTTP Host header and leaks Vertex credentialsCVE-2026-75871 · GitLab AI Gateway (Duo Agent Platform inline flow configuration)High
- Gradio: Command injectionCVE-2023-6572 · GradioHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.