Critical LangChain Core Vulnerability CVE-2025-68664 Exposes Secrets
- Securityish
- Threats & Incidents
Quick Summary
A critical vulnerability in LangChain Core, tracked as CVE-2025-68664, allows attackers to exploit serialization injection to steal sensitive information and manipulate large language model responses. Discovered by researcher Yarden Porat on December 4, 2025, this flaw has a CVSS score of 9.3 and affects versions of langchain-core prior to 1.2.5. The vulnerability enables secret extraction from environment variables and arbitrary code execution through unsafe deserialization, posing significant risks to users and organizations relying on this technology.
The Securityish Brief
A critical vulnerability has been identified in LangChain Core, specifically in its dumps() and dumpd() functions, which fail to properly escape user-controlled dictionaries containing ‘lc’ keys. This issue, tracked as CVE-2025-68664, was reported by security researcher Yarden Porat on December 4, 2025, and has been codenamed LangGrinch. The flaw allows attackers to potentially extract secrets from environment variables and execute arbitrary code through prompt injection.
The vulnerability affects versions of langchain-core that are >= 1.0.0 and < 1.2.5, as well as < 0.3.81, with the issue fixed in version 1.2.5. When user data includes the 'lc' key, it is treated as a legitimate LangChain object during deserialization, leading to unsafe object instantiation. This can trigger various attack paths, including secret extraction and arbitrary code execution.
Additionally, a similar serialization injection vulnerability exists in LangChain.js, identified as CVE-2025-68665, which also allows for secret extraction and prompt injection. This flaw has a CVSS score of 8.6 and affects npm packages such as @langchain/core and langchain.
In response to the critical nature of these vulnerabilities, LangChain has implemented a patch that introduces new defaults in the load() and loads() functions. This includes an allowlist parameter called ‘allowed_objects’ to restrict which classes can be serialized/deserialized, blocking Jinja2 templates by default, and disabling automatic secret loading from the environment.
Understanding the Risks
The most common attack vector involves LLM response fields like additional_kwargs or response_metadata, which can be manipulated via prompt injection. This highlights a significant intersection of AI and traditional security concerns, where organizations may be caught off guard by untrusted inputs from LLM outputs. Users and organizations must remain vigilant about the security of their applications that utilize LangChain technology.
Given the potential for serious exploitation, it is crucial for users to update to the patched versions of langchain-core and LangChain.js to mitigate these risks. Organizations should also review their configurations and ensure they are not inadvertently exposing sensitive data through these vulnerabilities.
Key Takeaways
- Update to the latest patched version of langchain-core to protect against CVE-2025-68664.
- Review your application configurations to ensure that sensitive data is not exposed through serialization.
- Monitor for any unusual behavior in applications using LangChain, especially in response fields.
- Educate your team about the risks of prompt injection and how it can affect LLM outputs.
- Implement security best practices for handling user-controlled data in your applications.
Key Terms & Concepts
- CVE-2025-68664: In this article, CVE-2025-68664 refers to a critical vulnerability in LangChain Core that allows for serialization injection and secret extraction.
- serialization injection: Serialization injection is a type of vulnerability where an attacker can manipulate serialized data to execute unauthorized actions or extract sensitive information.
- LangChain: LangChain is a Python package that provides core interfaces and abstractions for building applications powered by large language models.
- CVSS: CVSS stands for Common Vulnerability Scoring System, which is used to assess the severity of vulnerabilities on a scale from 0 to 10.
- prompt injection: Prompt injection is a technique where an attacker manipulates input fields to influence the behavior of language models.
Read the original article here: https://thehackernews.com/2025/12/critical-langchain-core-vulnerability.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
