Critical Lang Chain Core Vulnerability Exposes Secrets via Serialization Injection
Summary: A critical serialization injection flaw in LangChain Core, tracked as CVE-2025-68664 with a CVSS score of 9.3, was reported by researcher Yarden Porat on December 4, 2025 and codenamed LangGrinch. The dumps() and dumpd() functions fail to escape dictionaries containing 'lc' keys, so user-controlled data is treated as a legitimate LangChain object during deserialization, enabling secret extraction from environment variables, instantiation of classes in trusted namespaces, and possible arbitrary code execution via Jinja2 templates. A related flaw in LangChain.js, CVE-2025-68665 with a CVSS score of 8.6, stems from the same failure to escape 'lc' keys.
Bottom line: Porat notes the most common attack vector is LLM response fields like additional_kwargs and response_metadata, which prompt injection can control before they are serialized and deserialized in streaming operations - meaning LLM output is untrusted input that reaches your secrets.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Mentions
- CVE-2025-68664CVE-2025-68665
- Related
- ⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More Cyber Risks ·Lang Chain, Lang Graph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks Cyber Risks ·SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026