CVE-2025-68664
Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 42.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- EPSS
- 42.93% probability · 99th percentile
- Public exploits
- 1 in Exploit-DB · first 29 April 2026
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- langchain/langchain core
- Source
- security-advisories@github.com
EPSS 42.9% since 26 October 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8Patch
- https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6Patch
- https://github.com/langchain-ai/langchain/pull/34455Issue Tracking, Patch
- https://github.com/langchain-ai/langchain/pull/34458Issue Tracking, Patch
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81Release Notes
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5Release Notes
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cmExploit, Vendor Advisory
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cmExploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.