CVE-2025-68665

216.73.217.176

· Published 23/12/2025 23:15 · Modified 24/12/2025 15:16

Labels: CVE-2025-68665 2025-12-23 CVE-2025-68665 CWE-502 [email protected]

Essential information

Published: 23/12/2025 23:15
Modified: 24/12/2025 15:16
Author: —
Creator: —
CVSS: 8.6 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVSS metrics

Description

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3

NVD status

Status: Received — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
langchain / langchain	`cpe:2.3:a:langchain:langchain:0.3.37-0.3.79:::::::*`
langchain / langchain	`cpe:2.3:a:langchain:langchain:1.2.0-1.2.2:::::::*`
langchain / core	`cpe:2.3:a:langchain:core:0.3.80:::::::*`
langchain / core	`cpe:2.3:a:langchain:core:1.1.8:::::::*`