Skip to content
fr Sign in
9.3 Critical

CVE-2025-68664 LangChain is a framework for building agents and LLM-powered applications

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Affected products and versions

Product Affected versions Fixed in
langchain 1.0 1.0.0 → < 1.2.5 1.2.5
langchain 0.3 earliest → < 0.3.81 0.3.81

References

Timeline

  1. Published
  2. Last modified

Other CVEs of langchain

The 9 CVEs of langchain →
CVE-2026-55443 LangChain is a framework for building agents and LLM-powered applications 5.1 Medium CVE-2026-44843 LangChain is a framework for building agents and LLM-powered applications 8.2 High CVE-2026-40087 LangChain is a framework for building agents and LLM-powered applications 5.3 Medium CVE-2026-34070 LangChain is a framework for building agents and LLM-powered applications 7.5 High
Track this CVE