The “lc” Leak: Critical 9.3 Severity LangChain Flaw Turns Prompt Injections into Secret Theft

The article reports a critical vulnerability in LangChain, tracked as CVE-2025-68664, with a CVSS score of 9.3 that could allow attackers to extract environment variable secrets or trigger unintended system actions. The flaw arises from how LangChain handles data serialization, failing to escape dictionaries containing the internal key “lc” during dumps() and dumpd(), which can cause user-controlled data to be misinterpreted as legitimate LangChain objects during deserialization.

The advisory highlights that the most common attack vector is through LLM response fields such as additional_kwargs or response_metadata, controllable via prompt injection. In practice, an attacker could manipulate an LLM to output a specific JSON structure, and when the application processes this, it could deserialise and expose hidden credentials, especially if secrets_from_env is set to true.

The vulnerability also enables the instantiation of arbitrary classes within trusted namespaces, potentially leading to side effects like network calls or file operations. LangChain has released patches: LangChain 1.2.5 and LangChain Core 0.3.81, which address the escaping logic to ensure the “lc” key is treated as harmless data rather than a command, according to CVE-WATCHTOWER.