Serialization Injection Vulnerability in LangChain Framework
CVE-2025-68664
What is CVE-2025-68664?
The LangChain framework, designed for building agents and LLM-powered applications, contains a serialization injection vulnerability in its dumps() and dumpd() functions. This flaw arises from the handling of user-controlled data, specifically when dictionaries containing 'lc' keys are serialized. The framework mistakenly treats these 'lc' keys, which are meant for internal use, as legitimate LangChain objects during the deserialization process instead of simple user data. This behavior poses security risks as it may allow malicious actors to execute unexpected code or manipulate the application logic. The issue has been appropriately addressed in LangChain versions 0.3.81 and 1.2.5, which provide essential protections against this vulnerability.
Affected Version(s)
langchain >= 1.0.0, < 1.2.5 < 1.0.0, 1.2.5
langchain < 0.3.81 < 0.3.81