AG-DESERIALIZE: Insecure Deserialization

What this rule means

A function deserializes tool-controlled data via pickle/marshal/dill/joblib or an equivalent format that executes code or constructs arbitrary objects on load. A poisoned payload is remote code execution.

Why it matters

CVE-2025-68664 ("LangGrinch", CVSS 9.3): langchain-core's `dumps()`/`load()` allowed arbitrary object reconstruction; patched in 0.3.81 and 1.2.5.

How to fix it

Never deserialize untrusted data with pickle/marshal/dill/joblib. Use a data-only format (json, yaml.safe_load) or verify an HMAC/signature over the bytes before loading.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-DESERIALIZE          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules