# CVE-2025-68664: LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

Source: https://junglewise.ai/threats/cve-2025-68664-langchain-serialization-injection-vulnerability-enables-secret  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-23  
License: CC BY 4.0 with a link back

CVE-2025-68664 · Severity: critical · CVSS 9.3 · Published 2025-12-23

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Technologies: [Langchain Core](https://junglewise.ai/threats/technologies/langchain-langchain-core), [langchain-core (PyPI)](https://junglewise.ai/threats/technologies/langchain-core). Vendors: [LangChain](https://junglewise.ai/threats/vendors/langchain), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-68664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68664 being exploited in the wild.

**How severe is CVE-2025-68664?** Critical severity, with a CVSS score of 9.3, published 23 December 2025.

**Which products and versions are affected?** langchain-core (PyPI) >= 1.0.0, < 1.2.5, ECOSYSTEM:introduced=0,fixed=0.3.81,introduced=1.0.0,fixed=1.2.5, ECOSYSTEM:introduced=1.0.0,fixed=1.2.5.

**Is there a fix for CVE-2025-68664?** Yes. langchain-core (PyPI): upgrade to 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-68664?** Check whether you run Langchain Core or langchain-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- langchain-core (PyPI): upgrade to 1.2.5 or later

  ```sh
  pip install "langchain-core>=1.2.5"
  ```


## Affected products

- Langchain Core
- langchain-core (PyPI) >= 1.0.0, < 1.2.5, ECOSYSTEM:introduced=0,fixed=0.3.81,introduced=1.0.0,fixed=1.2.5, ECOSYSTEM:introduced=1.0.0,fixed=1.2.5

## Identifiers

- CVE-2025-68664
- GHSA-c67j-w6g6-q2cm
- PYSEC-2026-373

## Related threats

- [PYSEC-2026-2562 - LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages](https://junglewise.ai/threats/cve-2026-26013-langchain-chatopenai-server-side-request-forgery-via-image-token)
- [PYSEC-2026-1517 - langchain-core allows unauthorized users to read arbitrary files from the host file system](https://junglewise.ai/threats/cve-2024-10940-langchain-core-allows-unauthorized-users-to-read-arbitrary-files)
- [PYSEC-2026-1519 - LangChain's XMLOutputParser vulnerable to XML Entity Expansion](https://junglewise.ai/threats/cve-2024-1455-langchain-s-xmloutputparser-vulnerable-to-xml-entity-expansion)
- [LangChain unsafe deserialization in load() via broad object allowlists](https://junglewise.ai/threats/cve-2026-44843-langchain-unsafe-deserialization-in-load-via-broad-object)
- [LangChain incomplete f-string validation in prompt templates](https://junglewise.ai/threats/cve-2026-40087-langchain-incomplete-f-string-validation-in-prompt-templates)