{"id":"CVE-2025-68664","title":"langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)","summary":"A flaw was found in LangChain, a framework for building agents and LLM-powered applications. A remote attacker can exploit a serialization injection vulnerability in LangChain's `dumps()` and `dumpd()` functions. This occurs because the fu…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","cvssSource":"vendor","cwe":"CWE-502","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5","affected":["ansible_automation_platform 2.4","ansible_automation_platform 2.5","ansible_automation_platform 2.6","openshift_lightspeed 1.1.4"],"patched":["ansible_automation_platform 2.4","ansible_automation_platform 2.5","ansible_automation_platform 2.6","openshift_lightspeed 1.1.4"],"published":"2025-12-23","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:01:11+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68664.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68664.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-68664"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2424790"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68664"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68664"},{"url":"https://github.com/langchain-ai/langchain/commit/5ec0fa69de31bbe3d76e4cf9cd65a6accb8466c8"},{"url":"https://github.com/langchain-ai/langchain/commit/d9ec4c5cc78960abd37da79b0250f5642e6f0ce6"},{"url":"https://github.com/langchain-ai/langchain/pull/34455"},{"url":"https://github.com/langchain-ai/langchain/pull/34458"},{"url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.81"},{"url":"https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.5"},{"url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm"},{"url":"https://access.redhat.com/errata/RHSA-2026:0406"},{"url":"https://access.redhat.com/errata/RHSA-2026:0409"},{"url":"https://access.redhat.com/errata/RHSA-2026:0408"},{"url":"https://access.redhat.com/errata/RHSA-2026:1610"},{"url":"https://github.com/langchain-ai/langchain"}],"tags":["csaf","vex","red-hat","exploit-available","osv","pip"],"epss":0.4293,"epssPercentile":0.98698,"exploits":{"exploitdb":true,"github":3,"githubRepos":["https://github.com/Ak-cybe/CVE-2025-68664-LangGrinch-PoC","https://github.com/comerc/CVE-2025-68664","https://github.com/Johnnyzhou666/langgrinch-cve-2025-68664-analysis"],"checkedAt":"2026-09-21T16:44:46.136Z"},"exploitAvailable":true,"aliases":["GHSA-c67j-w6g6-q2cm","PYSEC-2026-373"],"ecosystem":"pip","ingestedAt":"2026-09-12T03:13:01.687Z","slug":"CVE-2025-68664","body":"## Overview\n\nA flaw was found in LangChain, a framework for building agents and LLM-powered applications. A remote attacker can exploit a serialization injection vulnerability in LangChain's `dumps()` and `dumpd()` functions. This occurs because the functions do not properly escape dictionaries containing the internal 'lc' key during serialization. When user-controlled data includes this key structure, it is incorrectly processed as a legitimate LangChain object during deserialization, potentially leading to arbitrary code execution.\n\n## Vendor advisories\n\n- **RHSA-2026:0406** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.4 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0406)\n- **RHSA-2026:0409** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0409)\n- **RHSA-2026:0408** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-01-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:0408)\n- **RHSA-2026:1610** · Red Hat · fixed in: Red Hat OpenShift Lightspeed 1.1.4 · released 2026-01-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:1610)\n\n**langchain-core: LangChain: Arbitrary code execution via serialization injection** — rated Critical by Red Hat. Released 2025-12-23, updated 2026-09-21.\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.4\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat OpenShift Lightspeed 1.1.4\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2.4\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat OpenShift Lightspeed 1.1.4\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI)\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.4#Installation%20and%20upgrade https://access.redhat.com/errata/RHSA-2026:0406\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading https://access.redhat.com/errata/RHSA-2026:0409\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade https://access.redhat.com/errata/RHSA-2026:0408\n\n## Package advisory (CVE-2025-68664)\n\nAffected packages:\n\n- `langchain-core >= 1.0.0, < 1.2.5`\n- `langchain-core < 0.3.81`\n\nPatched in:\n\n- `langchain-core 1.2.5`\n- `langchain-core 0.3.81`\n\nSource: https://osv.dev/vulnerability/GHSA-c67j-w6g6-q2cm","depth":"abyssal","depthScore":72,"depthScoreParts":{"impact":51.2,"likelihood":8.6,"exploitation":12,"ransomware":0},"changes":[]}