LangChain core vulnerability allows prompt injection and data exposure

A critical vulnerability in LangChain Core could allow attackers to steal secrets and manipulate LLM responses through prompt injection, tracked as CVE-2025-68664 with a CVSS score of 9.3. The flaw arises in LangChain’s dumps() and dumpd() functions, which fail to escape dictionaries containing the internal “lc” key during serialization, causing user-controlled data to be treated as LangChain objects during deserialization.

By manipulating such data in fields like metadata or response data, an attacker could inject unsafe object structures and potentially trigger code execution via Jinja2 templates, with the risk of secret leakage from environment variables and the instantiation of classes within trusted namespaces such as langchain_core or langchain_community.

Cyata researcher Yarden Porat described the issue as stemming from two functions that do not escape user-controlled dictionaries containing “lc” keys, enabling a LangChain loop to serialize and deserialize content that may instantiate unsafe objects. Patches are available in versions 1.2.5 and 0.3.81, and users are urged to update promptly.