CVE-2025-68664LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
- 9.3CriticalCVSS base score
- 42.9%Exploitation in 30 daysEPSS · top 1.3% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 1Public exploitsMetasploit, Nuclei and Exploit-DB
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list an Exploit-DB entry for it. A reference of the record is tagged as an exploit. CISA's SSVC rates its exploitation: a proof of concept is public.
Show the exploits2
Exploit-DB1 entry
- LangChain Core 1.2.4 - SSTI/RCE (Exploit-DB entry) (opens in a new tab)
EDB-ID 52514webapps, multiplepublished 29 Apr 2026Not verified
References tagged exploit1 reference
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm (opens in a new tab)x_refsource_CONFIRMexploit
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By GitHub_M
- 1 day later
· 1 day later
Published
- 1 day later
· 1 day later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Critical9.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
- EPSS (exploitation in 30 days)
- 42.9% · top 1.3% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.
Affected products
- affected >= 1.0.0, < 1.2.5
- affected < 0.3.81
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIlangchain-coreGHSA-c67j-w6g6-q2cm (opens in a new tab)
References
References7
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm (opens in a new tab)x_refsource_CONFIRMexploit
- https://github.com/langchain-ai/langchain/pull/34455 (opens in a new tab)x_refsource_MISC
- https://github.com/langchain-ai/langchain/pull/34458 (opens in a new tab)x_refsource_MISC
- https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8 (opens in a new tab)x_refsource_MISC
- https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6 (opens in a new tab)x_refsource_MISC
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81 (opens in a new tab)x_refsource_MISC
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-204849 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-c67j-w6g6-q2cm (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-68664)Record last updated .