Aller au contenu
en Se connecter
9.3 Critique

CVE-2025-68664 LangChain is a framework for building agents and LLM-powered applications

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Produits et versions touchés

Produit Versions touchées Corrigé en
langchain 1.0 1.0.0 → < 1.2.5 1.2.5
langchain 0.3 premières → < 0.3.81 0.3.81

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de langchain

Les 9 CVE de langchain →
CVE-2026-55443 LangChain is a framework for building agents and LLM-powered applications 5.1 Moyenne CVE-2026-44843 LangChain is a framework for building agents and LLM-powered applications 8.2 Élevée CVE-2026-40087 LangChain is a framework for building agents and LLM-powered applications 5.3 Moyenne CVE-2026-34070 LangChain is a framework for building agents and LLM-powered applications 7.5 Élevée
Suivre cette CVE