CVE-2025-68664

🗓️ 23 Dec 2025 22:47:44Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 15 Media mentions👁 63 Views

LangChain dumps and dumpd serialization injection allows secret extraction via the lc key; fixed in versions 0.3.81 and 1.2.5.

Reporter	Title	Published	Views	Family All 43
IBM Security Bulletins	Security Bulletin: LangChain Serialization Injection Vulnerability in dumps()/dumpd() (Fixed in 0.3.81 / 1.2.5) affects watsonx.data	8 Apr 202610:44	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:24	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js and LangChain	25 Feb 202616:32	–	ibm
GithubExploit	cve-research	25 Jun 202621:29	–	githubexploit
GithubExploit	Exploit for CVE-2025-68664	27 Dec 202506:49	–	githubexploit
Chainguard	CVE-2025-68664 vulnerabilities	17 Jan 202601:17	–	cgr
Circl	CVE-2025-68664	23 Dec 202523:44	–	circl
CNNVD	LangChain 代码问题漏洞	23 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs	23 Dec 202522:47	–	cvelist
Exploit DB	LangChain Core 1.2.4 - SSTI/RCE	29 Apr 202600:00	–	exploitdb

NVD

Vulners

Node

langchain langchain_coreRange<0.3.81python

langchain langchain_coreRange1.0.0–1.2.5python

[
  {
    "vendor": "langchain-ai",
    "product": "langchain",
    "versions": [
      {
        "version": ">= 1.0.0, < 1.2.5",
        "status": "affected"
      },
      {
        "version": "< 0.3.81",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8
github	www.github.com/langchain-ai/langchain/pull/34458
github	www.github.com/langchain-ai/langchain/pull/34455
github	www.github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm
github	www.github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6
github	www.github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5
github	www.github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81

17 Jun 2026 09:59Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.18.2 - 9.3

EPSS0.41454

SSVC

CWE-502