CVE-2025-68665 LangChain serialization injection vulnerability enables secret extraction
Attackers can inject malicious objects via user-controlled data to extract secrets or execute code during deserialization in LangChain JS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68665?
CVE-2025-68665 is a high-severity unsafe deserialization vulnerability in langchain-ai langchainjs, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3
Weakness: CWE-502
Which versions are affected by CVE-2025-68665?
8 open source packages ship an affected version, including @langchain/core and langchain. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
@langchain/core npm | All versions | 0.3.80 |
@langchain/core npm | All versions | 0.3.80 |
@langchain/core npm | From 1.0.0 | 1.1.8 |
@langchain/core npm | From 1.0.0 | 1.1.8 |
langchain npm | All versions | 0.3.37 |
langchain npm | All versions | 0.3.37 |
2 more packages
langchain npm | From 1.0.0 | 1.2.3 |
langchain npm | From 1.0.0 | 1.2.3 |
Products include Langchain Langchain.js, Langchain Langchain\/Core.
How do I fix CVE-2025-68665?
Upgrade @langchain/core to a fixed version for your release line: 0.3.80 or 1.1.8.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-68665 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68665 exists.
Other vulnerabilities in langchain-ai langchainjs
Sources
Also known as CLEANSTART-2026-CZ76970, CLEANSTART-2026-TX70118, ECHO-8c60-58c3-e7a5, GHSA-r399-636x-v7f6, MINI-2pfh-rpgg-45qm, MINI-8mhc-xcr8-5jf9 and 8 more.