Loading vulnerability…
CVE-2025-68664 is a critical serialization injection / deserialization of untrusted data vulnerability in LangChain Core. In vulnerable versions, LangChain's dumps() and dumpd() functions fail to properly escape free-form user-controlled dictionaries containing the reserved internal key "lc". Because "lc" is used by LangChain to denote serialized framework objects, attacker-controlled input with that structure can later be interpreted by load()/loads() and related deserialization paths as a legitimate LangChain object rather than inert user data. This breaks the trust boundary between untrusted application/LLM data and trusted serialized objects. Reported attack paths include prompt-injection-controlled LLM output fields such as additional_kwargs, response_metadata, metadata, tool outputs, cached generations, and other internal flows that serialize and later deserialize data. The issue can enable revival or instantiation of trusted Serializable classes from allowlisted namespaces, secret resolution objects, and in some configurations Jinja2-backed template objects. The vulnerability affects langchain-core versions prior to 0.3.81 and 1.x versions prior to 1.2.5; patches were released in 0.3.81 and 1.2.5.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (3 hidden).
This repository provides a comprehensive proof-of-concept (PoC) and payload arsenal for exploiting CVE-2025-68664, a critical deserialization vulnerability in the LangChain Core Python package. The vulnerability allows attackers to inject specially crafted JSON objects (with an 'lc' marker) into deserialization routines, leading to environment secret extraction, SSRF, remote code execution, and file system access. The repository includes: - README.md: Detailed writeup, vulnerability analysis, and usage instructions. - PAYLOADS.md: Over 55 categorized payloads for secret extraction, SSRF, RCE, file access, and evasion. - langgrinch_fuzzer.py: A Python tool to generate, customize, and export payloads, as well as automate testing against targets. - requirements.txt: Python dependencies for running the fuzzer and optional testing. The main exploit capabilities are: 1. Extraction of sensitive environment variables (API keys, DB credentials, etc.). 2. Triggering SSRF to attacker-controlled HTTP endpoints by abusing deserialization gadgets in LangChain. 3. Achieving remote code execution or file read via advanced payloads. The exploit is operational and provides both ready-to-use and customizable payloads. The attack vectors are both network (SSRF, exfiltration) and local (environment variable and file access). The repository is well-documented and intended for authorized security testing only.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
92 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A deserialization of untrusted data vulnerability in LangChain that can expose API keys and environment secrets.
A critical serialization vulnerability in LangChain Core (CVE-2025-68664) allows unescaped 'lc' markers in user-controlled data to revive unsafe objects during deserialization, enabling secret extraction and arbitrary object instantiation. This can be exploited via attacker-controlled LLM outputs, leading to potential secret exfiltration and remote code execution risks.
Deserialization/serialization confusion in LangChain (Python `langchain-core`) where attacker-controlled data using the internal `lc` key can be treated as trusted objects, enabling secret extraction (env vars), arbitrary object instantiation, and potentially code execution (e.g., via Jinja2).
Critical LangChain Core issue where unsafe deserialization and related high-risk defaults (e.g., templating and secrets loading) can allow prompt-injection-driven secret extraction and potentially code execution paths; model output must be treated as untrusted input.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.