LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

🗓️ 23 Dec 2025 18:46:13Reported by GitHub Advisory DatabaseType

LangChain dumps and dumpd allow object injection via internal key; fixed with escaping and stricter load defaults.

Reporter	Title	Published	Views	Family All 36
IBM Security Bulletins	Security Bulletin: LangChain Serialization Injection Vulnerability in dumps()/dumpd() (Fixed in 0.3.81 / 1.2.5) affects watsonx.data	8 Apr 202610:44	–	ibm
IBM Security Bulletins	Security Bulletin: The IBM Maximo Application Suite AI-Service component uses multiple third-party dependencies that contain vulnerabilities associated with multiple CVEs.	2 Feb 202604:24	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Node.js and LangChain	25 Feb 202616:32	–	ibm
Chainguard	CVE-2025-68664 vulnerabilities	17 Jan 202601:17	–	cgr
Circl	CVE-2025-68664	23 Dec 202523:44	–	circl
CNNVD	LangChain 代码问题漏洞	23 Dec 202500:00	–	cnnvd
CVE	CVE-2025-68664	23 Dec 202522:47	–	cve
Cvelist	CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs	23 Dec 202522:47	–	cvelist
Exploit DB	LangChain Core 1.2.4 - SSTI/RCE	29 Apr 202600:00	–	exploitdb
GithubExploit	Exploit for CVE-2025-68664	27 Dec 202506:49	–	githubexploit

Vulners

Node

langchain-coreRange<0.3.81pip

langchain-coreRange1.0.0–1.2.5pip

Source	Link
github	www.github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm
github	www.github.com/langchain-ai/langchain/pull/34455
github	www.github.com/langchain-ai/langchain/pull/34458
github	www.github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8
github	www.github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6
github	www.github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81
github	www.github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-68664
github	www.github.com/advisories/GHSA-c67j-w6g6-q2cm

24 Dec 2025 01:08Current

7.8High risk

Vulners AI Score7.8

CVSS 3.18.2 - 9.3

EPSS0.02624

SSVC