LangChain loads a saved index with dangerous deserialization on
HighAV-FW-015Runtime safetyFramework packNew in 2.0
What it finds
A LangChain vector store (FAISS, etc.) is loaded with allow_dangerous_deserialization=True.
Why it matters
That flag loads the index with pickle, which runs code. If the index file is ever replaced or comes from someone else, loading it runs their code.
What an attacker could do: A tampered index file executes code when the agent starts.
How to fix it
Only load index files you created and store them where no one else can write. Prefer a hosted vector database or a format that does not use pickle.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- LANGCHAIN_DANGEROUS_DESERIALIZATION
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Agent source using the named framework (LangChain, CrewAI, AutoGen, OpenAI Agents SDK, Claude Agent SDK, computer-use tools)
- OWASP LLM Top 10
- LLM05 - Supply Chain Vulnerabilities
- NIST AI RMF
- MS-2.3
- SOC 2
- CC7.1
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Command injection riskAV-RUNTIME-004 · Critical
- Unsafe dynamic code executionAV-RUNTIME-005 · Critical
- Privileged or host-mounted container configurationAV-RUNTIME-007 · Critical
- SQL query built from unescaped inputAV-RUNTIME-009 · Critical
- Unsafe deserialization of untrusted dataAV-RUNTIME-010 · Critical
- Prompt injection surface detectedAV-RUNTIME-002 · High