CVE-2026-44843

🗓️ 26 May 2026 19:47:35Reported by MendType

mend🔗 www.mend.io👁 8 Views

LangChain deserialization of payloads using broad object allowlists allows class instantiation.

Reporter	Title	Published	Views	Family All 47
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	2 Jul 202610:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Deserialization of Untrusted Data in LangChain [CVE-2026-44843]	27 Jul 202620:22	–	ibm
attackerkb	CVE-2026-44843	26 May 202619:47	–	attackerkb
Chainguard	CVE-2026-44843 vulnerabilities	3 Jun 202607:18	–	cgr
Circl	CVE-2026-44843	11 May 202608:55	–	circl
CNNVD	LangChain 代码问题漏洞	26 May 202600:00	–	cnnvd
CVE	CVE-2026-44843	26 May 202619:47	–	cve
Cvelist	CVE-2026-44843 LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists	26 May 202619:47	–	cvelist
EUVD	EUVD-2026-31976	26 May 202619:47	–	euvd
Github Security Blog	LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists	8 May 202623:07	–	github

Vulners

Node

OR

langchain langchain_coreRange1.0.0–1.3.3

langchain langchain_coreRange0.0.1–0.3.85

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44843.json
github	www.github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44843
github	www.github.com/langchain-ai/langchain
github	www.github.com/advisories/GHSA-pjwx-r37v-7724
pypi	www.pypi.org/project/langchain-core

07 Oct 2026 22:48Current

CVSS 3.18.2

CVSS 48.8

EPSS0.00382

SSVC

LangChain deserialization class instantiation trusted LangChain-serializable object load()allowed_objects="all"