CVE-2025-68664

CVE-2025-68664 is a serialization injection vulnerability affecting LangChain and LangChain Core versions prior to 0.3.81 and 1.2.5. The vulnerability arises because the dumps() and dumpd() functions fail to properly escape dictionaries containing the internal 'lc' key when serializing free-form user data. This allows specially crafted user input to be misinterpreted as legitimate LangChain objects during deserialization. This vulnerability carries a CVSS score of 8.2 (HIGH), indicating a critical severity. It is a network-exploitable vulnerability with low attack complexity, requiring no user interaction. A successful exploit could lead to high confidentiality impact (data disclosure) and low integrity impact. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community attention with 16 mentions, including discussions on GitHub and Mastodon regarding its critical nature and potential for secret exposure.