Skip to main content
HIGH

CVE-2025-68664

CVSS v3

8.2

HIGH

EPSS Score

42.9 %

exploit probability, as of 2026-09-25

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Technical details

Published
2025-12-23
Exploit-DB
EDB-52514

Frequently asked questions

What is CVE-2025-68664?

LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.

Is CVE-2025-68664 actively exploited?

Active exploitation of CVE-2025-68664 has not been confirmed. Its EPSS score was 42.9% on 2026-09-25, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-68664?

CVE-2025-68664 has a CVSS v3 base score of 8.2 (HIGH severity).

Is CVE-2025-68664 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 500 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database