CVE-2025-68664

LangChain (langchain-core) versions prior to 0.3.81 and 1.2.5 contain a serialization injection flaw (CWE-502) in the dumps() and dumpd() functions, which fail to escape dictionaries carrying a top-level 'lc' key when serializing free-form dictionaries. Because 'lc' is LangChain's internal marker for serialized objects, an attacker who can get user-controlled data into a serialized payload can craft a forged LangChain object that is treated as a legitimate, trusted object when the payload is later deserialized. Successful exploitation can expose secrets embedded in serialized objects and enable prompt injection or broader data exposure, with network reachability and no privileges or user interaction required (CVSS 3.1: 8.2 high, high confidentiality and low integrity impact). Any application built on LangChain Core that passes attacker-influenced dictionaries through dumps()/dumpd() and deserializes the result is affected. Exploitation has not yet been confirmed in the wild (not in CISA KEV), but a public security advisory is available and EPSS assigns a 43.4% probability of exploitation within 30 days (99th percentile).

What to do: Upgrade langchain-core to version 0.3.81 (for the 0.3.x branch) or 1.2.5 (for the 1.x branch), or later. Audit code that calls dumps()/dumpd() on data containing user-controlled dictionaries and that deserializes such output, and avoid embedding secrets in serialized payloads until patched. Review the upstream advisory (GHSA-c67j-w6g6-q2cm) for exploitation details and monitor for signs of in-the-wild abuse given the high EPSS score.