Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

LangChain versions before 0.3.81 and 1.2.5 allow attackers to inject malicious code

CVE-2025-68664 · published 9 months ago
Summary

LangChain's serialization functions can accidentally treat user input as code, allowing an attacker to inject malicious actions into LangChain applications. This can lead to unauthorized actions within the application. Update to LangChain version 0.3.81 or 1.2.5 or later to fix this issue.

What to do
  • Update langchain-core to version 1.2.5.
  • Update langchain-core to version 0.3.81.
  • Update rootio-langchain-core to version 1.2.4+root.io.2.
  • Update rootio-langchain-core to version 1.2.4+root.io.3.
  • Update rootio-langchain-core to version 1.2.4+root.io.4.
  • Update rootio-langchain-core to version 1.0.2+root.io.4.
  • Update langchain-core to version 1.0.2+aikido.4.
  • Update langchain-core to version 0.3.72+aikido.3.
  • Update langchain-core to version 1.0.2+aikido.5.
Affected software
Ecosystem VendorProductAffected versions
pip – langchain-core >= 1.0.0, < 1.2.5
< 0.3.81
Fix: upgrade to 1.2.5
– langchain langchain_core < 0.3.81
>= 1.0.0, < 1.2.5
cpe:2.3:a:langchain:langchain_core:*:*:*:*:*:python:*:*
Root:PyPI – rootio-langchain-core < 1.2.4+root.io.2
< 1.2.4+root.io.3
< 1.2.4+root.io.4
< 1.0.2+root.io.4
Fix: upgrade to 1.2.4+root.io.2
Root:PyPI – langchain-core < 1.0.2+aikido.4
< 0.3.72+aikido.3
< 1.0.2+aikido.5
Fix: upgrade to 1.0.2+aikido.4
Original advisory text
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() func...
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
References
Severity
8.2 High
CVSS 3.1: 9.3 (GHSA)
Exploitation
EPSS 43%
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published23 Dec 2025
Updated19 Sep 2026
First seen6 Mar 2026
Sources
GHSA-c67j-w6g6-q2cm · GHSA
CVE-2025-68664 · NVD
ROOT-APP-PYPI-CVE-2025-68664 · OSV
Track software like this
Free during beta