Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection

A critical vulnerability has been disclosed in LangChain Core that allows a serialization injection attack to exfiltrate secrets and influence LLM responses, tracked as CVE-2025-68664 with a CVSS of 9.3. Security researcher Yarden Porat reported the flaw on 4 December 2025, and it has been dubbed LangGrinch.

The issue lies in LangChain’s dumps() and dumpd() functions, which fail to escape dictionaries containing the internal "lc" key used to mark serialized LangChain objects, enabling user‑controlled data to be treated as legitimate objects during deserialization.

According to Cyata researcher Porat, the problem centres on two functions not escaping such dictionaries, potentially allowing an attacker to instantiate unsafe objects and trigger attacker‑controlled paths, including secret extraction from environment variables when secrets_from_env is true.

The advisory notes a patch introducing a restrictive defaults change via an allowlist called allowed_objects and blocking Jinja2 templates by default, with secrets_from_env now set to False; affected versions include langchain-core >= 1.0.0, < 1.2.5 (fixed in 1.2.5) and < 0.3.81 (fixed in 0.3.81), and a related (but separate) vulnerability in LangChain.js identified as CVE-2025-68665 (CVSS 8.6).

The report also warns that the most common attack vector is through LLM response fields like additional_kwargs or response_metadata, which can be controlled via prompt injection and then serialized/deserialized in streaming operations. According to Porat, organisations should update to patched versions to mitigate the risk.