CVE-2025-68664 in langchain
Summary
by MITRE • 12/24/2025
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability identified as CVE-2025-68664 represents a critical serialization injection flaw within the LangChain framework that affects versions prior to 0.3.81 and 1.2.5. This issue stems from improper handling of dictionary serialization processes where the framework fails to adequately sanitize user-controlled data containing specific internal key structures. The vulnerability specifically impacts the dumps() and dumpd() functions which are responsible for serializing objects within the LangChain ecosystem, creating a pathway for malicious actors to manipulate the serialization process and potentially execute arbitrary code or manipulate application behavior.
The technical flaw manifests through the improper handling of dictionaries that contain 'lc' keys during the serialization process. The 'lc' key serves as an internal marker within LangChain to identify serialized objects, but when user-controlled data inadvertently contains this key structure, the framework treats it as a legitimate serialized object rather than plain user data. This misclassification occurs because LangChain's deserialization logic does not properly validate or sanitize the presence of these internal keys within user-provided dictionaries. The vulnerability is categorized under CWE-94, which describes "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.001 for command and scripting interpreter execution, as it enables attackers to inject malicious serialized objects that can be executed during deserialization.
The operational impact of this vulnerability extends beyond simple code injection to potentially compromise entire LangChain-based applications and their underlying infrastructure. When exploited, attackers can manipulate serialized objects to execute arbitrary code within the context of the application, potentially leading to data exfiltration, privilege escalation, or complete system compromise. The vulnerability affects applications that rely on LangChain's serialization capabilities for processing user input, making it particularly dangerous in web applications, chatbots, and AI-powered services where user data is frequently processed through the framework. This issue is especially concerning given that LangChain is widely used for building LLM-powered applications and agents, making the potential attack surface substantial across various industries including finance, healthcare, and enterprise services.
Mitigation strategies for CVE-2025-68664 require immediate implementation of the patched versions 0.3.81 and 1.2.5, which address the core serialization injection vulnerability through proper sanitization of user-controlled data containing internal keys. Organizations should also implement additional defensive measures including input validation and sanitization of all data processed through LangChain's serialization functions, monitoring for unexpected 'lc' key usage in user-provided data, and implementing proper access controls and least privilege principles for applications using LangChain. Security teams should conduct comprehensive code reviews to identify any custom implementations that might be vulnerable to similar injection patterns and ensure that all LangChain-based applications are updated to the patched versions. The vulnerability's remediation aligns with industry best practices for secure coding and follows the principle of least privilege as outlined in NIST SP 800-53 controls, while also addressing the specific threat model of serialized object manipulation as described in OWASP Top 10 2021 category A08: Software and Data Integrity Failures.