CriticalVulnerabilityLLM-specific
CVE-2025-68664: LangChain serialization injection in dumps and dumpd functions
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-68664
- Published
- Record updated
- Affected
- langchain-core >= 1.0.0, < 1.2.5, fixed in 1.2.5, released December 22, 2025, 2 days before disclosure
- langchain-core < 0.3.81, fixed in 0.3.81, released December 22, 2025, 1 day before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 42.9%
Summary
LangChain's dumps() and dumpd() functions do not escape dictionaries containing the 'lc' key when serializing free-form dictionaries. User-controlled data with this key structure is treated as a legitimate LangChain object during deserialization rather than plain data. The issue affects versions prior to 0.3.81 and 1.2.5.
Mitigation
This issue has been patched in versions 0.3.81 and 1.2.5.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchain-corePyPILLM dependency since 2023-11-20 · 60 tracked dependents
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database