Executive brief
LangChain pickle deserialization of untrusted data
Affected products
- PyPI langchain
- PyPI langchain-community
Junglewise Threat Intelligence
CVE-2024-5998: PYSEC-2026-1514 - LangChain pickle deserialization of untrusted data
CVE-2024-5998 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: langchain (PyPI), langchain-community (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2561 - Denial of service in langchain-community
- PYSEC-2026-1515 - Langchain Community Vulnerable to XML External Entity (XXE) Attacks
- PYSEC-2026-1507 - Langchain SQL Injection vulnerability
- PYSEC-2026-1516 - Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
- PYSEC-2026-1510 - langchain vulnerable to path traversal