9.3
CVE-2025-68664
- EPSS 13.83%
- Veröffentlicht 23.12.2025 22:47:44
- Zuletzt bearbeitet 13.01.2026 15:58:23
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Langchain ≫ Langchain Core SwPlatformpython Version < 0.3.81
Langchain ≫ Langchain Core SwPlatformpython Version >= 1.0.0 < 1.2.5
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 13.83% | 0.96 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.2 | 3.9 | 4.2 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
|
| security-advisories@github.com | 9.3 | 3.9 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
|
CWE-502 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm
https://github.com/langchain-ai/langchain/pull/34455
https://github.com/langchain-ai/langchain/pull/34458
https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8
https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6
https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81
https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5