9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68664

CVE-2025-68664: LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68664

CVE-2025-68664:

9.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langchain-core	pip	>= 1.0.0, < 1.2.5	1.2.5
langchain-core	pip	< 0.3.81	0.3.81

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a serialization injection issue in LangChain. It stems from two core problems that, when combined, allow for remote code execution and secret exfiltration.

First, the serialization functions langchain_core.load.dump.dumps and langchain_core.load.dump.dumpd failed to properly sanitize user-provided data. Specifically, they did not escape dictionaries that contained a special lc key. This key is used by LangChain to identify its own serialized objects. By crafting input with this key, an attacker could make arbitrary data appear as a legitimate LangChain object during serialization.

Second, the deserialization functions langchain_core.load.load.load and langchain_core.load.load.loads had insecure default settings. Most critically, the secrets_from_env parameter was set to True by default. This meant that if a serialized object contained a special "secret" structure, the deserializer would attempt to read the value of a specified environment variable and include it in the resulting object.

An attacker could exploit this by injecting a malicious dictionary (e.g., {'lc': 1, 'type': 'secret', 'id': ['ENV_VAR']}) into data that would be processed by dumps or dumpd. The resulting serialized string, when passed to load or loads, would cause the deserializer to read the ENV_VAR environment variable and return its value to the attacker.

The patch addresses both issues. It introduces an escaping mechanism in dumps and dumpd to prevent user data from being misinterpreted as LangChain objects. It also changes the defaults in load and loads to be secure, setting secrets_from_env to False and adding an allowlist (allowed_objects) for classes that can be deserialized.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.