LangChain is a framework for building agents and LLM-powered applications.
CVE-2025-68664
Summary A serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. Attack surface The core vulnerability was in dumps() and dumpd(): these functions failed to escape user-controlled dictionaries containing 'lc' keys. When this unescaped data was later deserialized via load() or loads(), the injected structures were treated as legitimate LangChain objects rather than plain user data. This escaping bug enabled several attack vectors: 1. Injection via user data: Malicious LangChain object structures could be injected through user-controlled fields like metadata, additionalkwargs, or responsemetadata 2. Class instantiation within trusted namespaces: Injected manifests could instantiate any Serializable subclass, but only within the pre-approved trusted namespaces (langchaincore, langchain, langchaincommunity). This includes classes…
A public exploit is available
Exploit-DB · Public PoC
- Exploit-DBLangChain Core 1.2.4 - SSTI/RCE
- Public PoCAk-cybe/CVE-2025-68664-LangGrinch-PoC3 stars
- Public PoCcomerc/CVE-2025-68664
- Public PoCJohnnyzhou666/langgrinch-cve-2025-68664-analysis
- Public PoCt-sorger/cve-2025-68664-langgrinch
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Part of the AI stack
This affects LangChain, in Agent frameworks.
Assessment
- CVSS
- 9.3 (v3.1)
- Severity
- Critical
- EPSS
- 42.93% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Exploit-DB, Public PoC
- Published
- 23 December 2025
- Last updated
- 27 October 2026
- Affected
- langchain-ai · langchain · langchain-core
- Weakness
- CWE-502
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
At the source
References
- https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8
- https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6
- https://github.com/langchain-ai/langchain/pull/34455
- https://github.com/langchain-ai/langchain/pull/34458
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm
- https://nvd.nist.gov/vuln/detail/CVE-2025-68664
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain-core/PYSEC-2026-373.yaml
- https://pypi.org/project/langchain-core
- https://github.com/advisories/GHSA-c67j-w6g6-q2cm
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2025-68664