CVE-2025-68664

CVE-2025-68664 私がクリスマスに欲しいのはあなたの秘密だけ: LangGrinchがLangChainコアを襲う（CVE-2025-68664） 著者: ヤルデン・ポラット Cyataリサーチ: LangChainにおけるLangGrinch脆弱性 公開: https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ 昨日、LangChainは、私がlangchain-coreで発見した脆弱性に関する重大なセキュリティアドバイザリを公開しました: CVE-2025-68664 /...

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

SummaryA serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data...

PYSEC-2026-373 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Summary A serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data...

Security Bulletin: LangChain Serialization Injection Vulnerability in dumps()/dumpd() (Fixed in 0.3.81 / 1.2.5) affects watsonx.data

Summary A serialization injection vulnerability in LangChain's dumps and dumpd functions pre-0.3.81 / 1.2.5 allows user-controlled data with 'lc' keys to be deserialized as objects. This issue is fixed in versions 0.3.81 and 1.2.5. This can affect watsonx.data. Vulnerability Details...

CVE-2025-68664

A flaw was found in LangChain, a framework for building agents and LLM-powered applications. A remote attacker can exploit a serialization injection vulnerability in LangChain's dumps and dumpd functions. This occurs because the functions do not properly escape dictionaries containing the interna...

CVE-2025-68664

CVE-2025-68664 (LangGrinch) is a serialization-injection vulnerability in the LangChain Core Python package. Affected versions prior to 0.3.81 and 1.2.5 fail to escape dictionaries containing the internal lc marker during dumps/dumpd, causing user-controlled data to be treated as legitimate LangC...

CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...

CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...

LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Summary A serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data...

PT-2025-52859

Name of the Vulnerable Software and Affected Versions: LangChain versions prior to 0.3.81 and 1.2.5 Description: A serialization injection vulnerability exists in LangChain's dumps and dumpd functions. These functions do not properly escape dictionaries containing 'lc' keys when serializing data...

CVE-2025-68664: Deserialization of Untrusted Data

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...