CVE-2025-68664: Langchain Core

High severity, CVSS 8.2. EPSS: 42.9% chance of exploitation in the next 30 days.

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Affected products

• Langchain Langchain Core: before 0.3.81 (fixed in 0.3.81); from 1.0.0, before 1.2.5 (fixed in 1.2.5)

Published 2025-12-23. Last modified 2026-06-17.