Serialization Injection Vulnerability

🗓️ 27 Jan 2026 14:28:01Reported by Veracode Vulnerability DatabaseType

LangChain serialization injection via toJSON of user objects with lc keys, risking parsing misuse.

Reporter	Title	Published	Views	Family All 36
Chainguard	CVE-2025-68665 vulnerabilities	30 Dec 202519:17	–	cgr
Circl	CVE-2025-68665	23 Dec 202523:44	–	circl
CNNVD	LangChain 代码问题漏洞	23 Dec 202500:00	–	cnnvd
CVE	CVE-2025-68665	23 Dec 202522:56	–	cve
Cvelist	CVE-2025-68665 LangChain serialization injection vulnerability enables secret extraction	23 Dec 202522:56	–	cvelist
IBM Security Bulletins	Security Bulletin: IBM Rhapsody Systems Engineering is using langchain-0.3.30 which is vulnerable to CVE-2025-68665	16 Mar 202610:58	–	ibm
EUVD	EUVD-2025-204846	23 Dec 202520:08	–	euvd
Github Security Blog	LangChain serialization injection vulnerability enables secret extraction	23 Dec 202520:08	–	github
NVD	CVE-2025-68665	23 Dec 202523:15	–	nvd
OSV	CGA-653Q-7MQW-VH62	5 Jan 202614:08	–	osv

Vulners

Node

core @langchain/coreRange1.0.0-alpha.1–1.1.7js

core @langchain/coreRange0.0.0–0.3.79js

core @langchain/coreRange1.0.0–1.1.8-dev-1766775128110js

langchain langchainRange1.0.0-alpha.1–1.2.2js

langchain langchainRange0.0.1–0.3.36js

langchain langchainRange1.0.0–1.2.3-dev-1766775128110js

Source	Link
github	www.github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcore%401.1.8
github	www.github.com/langchain-ai/langchainjs/commit/e5063f9c6e9989ea067dfdff39262b9e7b6aba62
github	www.github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.3
github	www.github.com/langchain-ai/langchainjs/security/advisories/GHSA-r399-636x-v7f6
github	www.github.com/advisories/GHSA-r399-636x-v7f6
github	www.github.com/langchain-ai/langchainjs/security/advisories/GHSA-r399-636x-v7f6

22 Jun 2026 20:45Current

6Medium risk

Vulners AI Score6

CVSS 3.18.6 - 9.1

EPSS0.00746

SSVC