CVE-2025-68665: LangChain Serialization Injection Vulnerability Enables Secret Extraction
Summary
CVE-2025-68665: LangChain serialization injection vulnerability enables secret extraction. Affects @langchain/core across 2 version ranges.
< 0.3.80
>= 1.0.0, < 1.1.8
Fixed in 0.3.80 or 1.1.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LangChain is an open-source framework designed for building applications with language models. It provides a set of tools and components that facilitate the integration of language models into various applications. The framework allows developers to serialize and deserialize objects for efficient data handling. However, a critical vulnerability has been identified in its serialization process, specifically in the toJSON() method, which can lead to severe security risks if untrusted data is processed.
Vulnerability Detail
A serialization injection vulnerability exists in LangChain JS's toJSON() method, which fails to escape user-controlled objects containing 'lc' keys during serialization. This oversight allows attackers to inject malicious structures through user data, leading to potential secret extraction and unauthorized class instantiation. When deserialized, these injected structures are treated as legitimate LangChain objects, enabling attackers to access sensitive environment variables and execute arbitrary code. The vulnerability affects applications that serialize untrusted data and those that directly deserialize user-controlled data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.3.800.3.80npm install @langchain/core@0.3.80 -
>= 1.0.0, < 1.1.81.1.8npm install @langchain/core@1.1.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not feasible, consider implementing the following workaround:
- Avoid deserializing untrusted data directly.
- Ensure that any data serialized with
JSON.stringify()does not include user-controlled fields that could contain 'lc' keys. - Use a stricter validation mechanism for user inputs before serialization.
Conclusion
The LangChain serialization injection vulnerability (CVE-2025-68665) poses significant risks to applications that handle untrusted data. By updating to the latest patched versions and implementing recommended workarounds, developers can mitigate these risks effectively.
See every vulnerability recorded for @langchain/core →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Attackers can extract sensitive environment variables and instantiate classes with controlled parameters, potentially leading to unauthorized access and execution of malicious code.
Yes, applications that serialize or deserialize untrusted data are at risk, especially if they include user-controlled fields that may contain 'lc' keys.
Implement workarounds such as avoiding deserialization of untrusted data and validating user inputs before serialization.
