Serialization Injection Vulnerability in LangChain Framework for LLM Applications
CVE-2025-68665
What is CVE-2025-68665?
The LangChain framework, used for building applications powered by large language models, has a serialization injection vulnerability in its toJSON() method. This flaw affects specific versions by improperly handling objects with 'lc' keys during the serialization of user data. As a result, user-controlled data that includes this key may be misinterpreted as legitimate LangChain objects upon deserialization, posing security risks. It is essential to upgrade to @langchain/core versions 0.3.80 and 1.1.8, or langchain versions 0.3.37 and 1.2.3 to mitigate this issue.
Affected Version(s)
langchainjs @langchain/core >= 1.0.0, < 1.1.8 < @langchain/core 1.0.0, 1.1.8
langchainjs @langchain/core < 0.3.80 < @langchain/core 0.3.80
langchainjs langchain >= 1.0.0, < 1.2.3 < langchain 1.0.0, 1.2.3