CVE-2025-68664

Katalog CVE

CVSS 8.2 · High EPSS 42,9%

Kerentanan Deserialization of Untrusted Data pada langchain core. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Rincian

Terbit di NVD

23 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

42,9% peluang dieksploitasi; lebih tinggi dari 98,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm exploit · advisory vendor
• https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8 patch
• https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6 patch
• https://github.com/langchain-ai/langchain/pull/34455 issue tracking · patch
• https://github.com/langchain-ai/langchain/pull/34458 issue tracking · patch
• https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81 release notes
• https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5 release notes