CVE-2025-68664

216.73.217.22

· Published 23/12/2025 23:15 · Modified 24/12/2025 15:16

Labels: CVE-2025-68664 2025-12-23 CVE-2025-68664 CWE-502 [email protected]

Essential information

Published: 23/12/2025 23:15
Modified: 24/12/2025 15:16
Author: —
Creator: —
CVSS: 9.3 CRITICAL (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

CVSS metrics

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
langchain / langchain	`cpe:2.3:a:langchain:langchain:<0.3.81:::::::*`
langchain / langchain	`cpe:2.3:a:langchain:langchain:<1.2.5:::::::*`