Remote Code Execution in LangChain via Unsafe Deserialization in `PickleballLoader`
Overview
A critical remote code execution (RCE) vulnerability was identified in the LangChain framework, specifically within a new, experimental document loader named `PickleballLoader`. This loader was designed to load `.pkl` files, a common format for saving serialized Python objects, directly into the LangChain document format. The vulnerability stems from the loader's direct use of Python's `pickle.load()` function on user-supplied files without any sanitization or sandboxing. The `pickle` module is known to be insecure against maliciously crafted data, as unpickling can execute arbitrary code. An attacker could craft a malicious `.pkl` file and trick an application using this loader into processing it. Upon loading, the malicious pickle payload would execute arbitrary Python code with the permissions of the application process. This could lead to a full server compromise, data exfiltration, or lateral movement within the host environment. The impact is critical for any application that allows users to upload documents for processing and uses the `PickleballLoader` as part of its document ingestion pipeline. The LangChain maintainers have since removed the loader from the library and issued a security advisory recommending against its use.
Affected Systems
Testing Guide
1. Check your project's dependencies for `langchain` and `langchain-community` versions. If they match the affected versions, you are potentially vulnerable. 2. Search your codebase for any usage of `PickleballLoader` from `langchain_community.document_loaders`. 3. If found, create a proof-of-concept malicious pickle file. In Python: `import pickle; import os; class RCE: def __reduce__(self): return (os.system, ('echo "vulnerable" > /tmp/pwned',)); with open('malicious.pkl', 'wb') as f: pickle.dump(RCE(), f)` 4. In your application environment, attempt to load `malicious.pkl` using the identified loader. 5. Check if the file `/tmp/pwned` was created. If it exists, your application is vulnerable to RCE.
Mitigation Steps
1. Immediately upgrade to `langchain` version `0.2.6` or higher and `langchain-community` to `0.1.4` or higher. 2. The `PickleballLoader` has been completely removed in the patched versions. 3. Audit your codebase to ensure no custom or third-party loaders are unsafely deserializing data from untrusted sources (e.g., using `pickle`, `PyYAML` with `yaml.unsafe_load`, etc.). 4. For loading complex data structures, use safer serialization formats like JSON, XML, or Protobuf, which do not carry executable code.
Patch Details
Patched in LangChain v0.2.6 and LangChain Community v0.1.4 by removing the vulnerable loader entirely.