Spotted what might be an issue in sandboxes/llm_local_langchain_core_v1.2.4/uv.lock around line 1.
The described vulnerability is a real issue in LangChain's dumps/dumpd serialization functions (they treat dictionaries containing 'lc' keys as internal objects), but the scanner incorrectly reports it based on a lock file (uv.lock) that contains no source code. Therefore, the finding as presented is a false positive.
Something like this might fix it:
Upgrade langchain-core to version 1.2.5 (or later) to include the fix for the serialization injection vulnerability.
For reference: rule CVE-2025-68664. Rated critical.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
sandboxes/llm_local_langchain_core_v1.2.4/uv.lockaround line 1.The described vulnerability is a real issue in LangChain's dumps/dumpd serialization functions (they treat dictionaries containing 'lc' keys as internal objects), but the scanner incorrectly reports it based on a lock file (uv.lock) that contains no source code. Therefore, the finding as presented is a false positive.
Something like this might fix it:
For reference: rule
CVE-2025-68664. Rated critical.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.