Security brief

LangChain Core serialization flaw could turn user data into trusted objects

REVIEW

CVE-2025-68664 affected serialization and loading paths; the advisory lists fixes in the 0.3 and 1.x branches.

Published 29 Oct 2026 · Material update 23 Dec 2025 — last time the underlying evidence changed · Evidence: high

What happened

LangChain’s advisory describes a serialization-injection flaw in langchain-core. User-controlled dictionaries containing an internal object marker could survive serialization and be interpreted as LangChain objects when later loaded.

Consequences included secret extraction under the earlier environment-secret default and side effects from permitted serializable classes. The advisory does not describe unrestricted loading of arbitrary classes outside trusted namespaces.

Affected ranges are below 0.3.81 and from 1.0.0 below 1.2.5. Upgrade to the corresponding fixed branch or a maintained release, and review loading behavior: the fix also changes security defaults that may affect existing integrations.

Read the original source.

Next step

Upgrade the affected branch and test integrations against the hardened loading defaults.

What we know

Fixed versions
0.3.81 and 1.2.5.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2025-68664