CVE-2026-44843

{**Immediate action:** Upgrade to patched versions: ```bash pip install --upgrade langchain>=0.3.85 langchain-core>=0.3.85 # For 1.x users pip install --upgrade langchain>=1.3.3 ``` **Interim workaround** if upgrade is blocked: ensure `load()` is never called on untrusted input. Wrap deserialization with input validation: ```python from langchain.load import loads def safe_load(data: str, allowed_namespaces: list[str]): obj = loads(data) if not obj.get("id", [None])[0] in allowed_namespaces: raise ValueError("Untrusted namespace") return obj ``` Audit any custom callback handlers or tool wrappers that deserialize agent state. **Rollback:** downgrade carries the vulnerability; test upgraded version in staging with full agent workflows before production deployment.}