LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

langchain-core (pip)

A serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects.

Fix it

langchain-core pip

On 0.x?pip install --upgrade "langchain-core>=0.3.81,<1"
On 1.x?pip install --upgrade "langchain-core>=1.2.5"

First seen: 23 Dec 2025
Last update: 23 Dec 2025, 18:46 UTC
Fixed in: langchain-core 1.2.5
langchain-core 0.3.81
Identifiers: CVE-2025-68664
Source: GitHub advisory
On the menu as: PyPI packages
LLM gateways

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Severity: critical. Patch status: patched.
Affected: langchain-core (pip)
Fixed in: langchain-core 1.2.5, langchain-core 0.3.81
Ids: CVE-2025-68664

A serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects.

## Steps
1. This incident involves a provider (ai-gateways). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-68664") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-c67j-w6g6-q2cm https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8 https://github.com/langchain-ai/langchain/pull/34455 https://github.com/langchain-ai/langchain/pull/34458 https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm
https://pwned.coffee/i/langchain-serialization-injection-vulnerability-enables-cve-2025-68664

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee