- LangChain Core contains a critical serialization injection flaw (CVE-2025-68664, CVSS 9.3) that can expose secrets and enable prompt injection.
- The bug stems from improper escaping of dictionaries with “lc” keys during serialization and deserialization in the library’s dump/load functions.
- Patches restrict allowed deserialized objects, disable automatic secret loading, and block Jinja2 templates by default; affected versions should be updated immediately.
LangChain Core, the Python core package for LangChain, contains a critical vulnerability disclosed in December 2025 that can let attackers extract secrets and influence LLM outputs. Security researcher Yarden Porat reported the issue on December 4, 2025; it is tracked as CVE-2025-68664 with a CVSS score of 9.3 and nicknamed LangGrinch. See the LangChain Core reference and the 1.2.5 package details.
The maintainers said the flaw is a problem in the library’s serialization functions, noting that “A serialization injection vulnerability exists in LangChain’s dumps() and dumpd() functions” in their advisory. A serialization injection vulnerability is when an attacker supplies specially crafted serialized data that is interpreted as executable or structured objects during deserialization.
The code fails to escape user-controlled dictionaries that include an “lc” key, which the framework uses internally to mark serialized objects. According to Porat, that lets an attacker cause the system to instantiate unsafe objects when content with an “lc” key is serialized and later deserialized.
Potential outcomes include extraction of environment secrets when deserialization runs with the previous default secrets_from_env=True, instantiation of classes in trusted namespaces (such as langchain_core, langchain, and langchain_community), and possible arbitrary code execution via Jinja2 templates. The escaping bug also enables injection through LLM output fields like metadata, additional_kwargs, or response_metadata.
The patch adds an allowlist parameter “allowed_objects” to restrict deserialized classes, blocks Jinja2 templates by default, and sets secrets_from_env to False. Affected langchain-core versions are >= 1.0.0, < 1.2.5 (fixed in 1.2.5) and < 0.3.81 (fixed in 0.3.81).
A related serialization injection issue affects LangChain.js and carries CVE-2025-68665 (CVSS 8.6); see the advisory for affected npm package versions and fixes. Users are advised to update to patched releases as soon as possible.
“The most common attack vector is through LLM response fields like additional_kwargs or response_metadata, which can be controlled via prompt injection and then serialized/deserialized in streaming operations,” Porat said in his write-up.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Major crypto airdrops loom in 2026 as giants prep tokens now
- Armstrong urges balanced crypto rules amid Coinbase lawsuit.
- Trust Wallet Chrome Extension Breach Drains $7M; Fix Issued.
- 100 Trillion SHIB Burn Could Boost Price by 184% – Bull Runs
- Binance Says SAFU Reserve Held in BTC, BNB and Stablecoins!!
