https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:20:37 +0000 https://vulnerability.circl.lu/vuln/ghsa-r399-636x-v7f6 <p><strong>Affected:</strong> npm: @langchain/core, npm: langchain</p> <p>## Context</p> <p>A serialization injection vulnerability exists in LangChain JS&#39;s `toJSON()` method (and subsequently when string-ifying objects using `JSON.stringify()`. The method did not escape objects with `&#39;lc&#39;` keys when serializing free-form data in kwargs. The `&#39;lc&#39;` key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data.</p> <p>### Attack surface</p> <p>The core vulnerability was in `Serializable.toJSON()`: this method failed to escape user-controlled objects containing `&#39;lc&#39;` keys within kwargs (e.g., `additional_kwargs`, `metadata`, `response_metadata`). When this unescaped data was later deserialized via `load()`, the injected structures were treated as legitimate LangChain objects rather than plain user data.</p> <p>This escaping bug enabled several attack vectors:</p> <p>1. **Injection via user data**: Malicious LangChain object structures could be injected through user-controlled fields like `metadata`, `additional_kwargs`, or `response_metadata` 2. **Secret extraction**: Injected secret structures could extract environment variables when `secretsFromEnv` was enabled (which had no explicit default, effectively defaulting to `true` behavior) 3. **Class instantiation via import maps**: Injected constructor structures could instantiate any class available in the provided import maps with attacker-controlled parameters</p> <p>**Note on imp…</p> <p><strong>Affected:</strong> npm: @langchain/core, npm: langchain</p> <p>## Context</p> <p>A serialization injection vulnerability exists in LangChain JS&#39;s `toJSON()` method (and subsequently when string-ifying objects using `JSON.stringify()`. The method did not escape objects with `&#39;lc&#39;` keys when serializing free-form data in kwargs. The `&#39;lc&#39;` key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data.</p> <p>### Attack surface</p> <p>The core vulnerability was in `Serializable.toJSON()`: this method failed to escape user-controlled objects containing `&#39;lc&#39;` keys within kwargs (e.g., `additional_kwargs`, `metadata`, `response_metadata`). When this unescaped data was later deserialized via `load()`, the injected structures were treated as legitimate LangChain objects rather than plain user data.</p> <p>This escaping bug enabled several attack vectors:</p> <p>1. **Injection via user data**: Malicious LangChain object structures could be injected through user-controlled fields like `metadata`, `additional_kwargs`, or `response_metadata` 2. **Secret extraction**: Injected secret structures could extract environment variables when `secretsFromEnv` was enabled (which had no explicit default, effectively defaulting to `true` behavior) 3. **Class instantiation via import maps**: Injected constructor structures could instantiate any class available in the provided import maps with attacker-controlled parameters</p> <p>**Note on imp…</p> https://vulnerability.circl.lu/vuln/ghsa-r399-636x-v7f6