CVE-2025-68664: 
Python vulnerability analysis and mitigation

CVE-2025-68664 is a serialization injection vulnerability in LangChain's dumps()/dumpd() and load()/loads() APIs, dubbed LangGrinch, that allows attackers who control serialized data to extract environment variable secrets and instantiate arbitrary classes within trusted namespaces. It affects langchain-core versions below 0.3.81 and 1.0.0–1.2.5 (exclusive), as well as langchain versions in the same ranges. The vulnerability was disclosed on December 23, 2025 via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 9.3 (Critical) per the GitHub advisory (GitHub Advisory) and 8.2 (High) per NVD scoring (Feedly).

The root cause (CWE-502: Deserialization of Untrusted Data) lies in dumps() and dumpd() failing to escape user-controlled dictionaries containing the 'lc' key — LangChain's internal marker for serialized objects. When such unescaped data is later passed to load() or loads(), the deserializer treats injected structures as legitimate LangChain objects rather than plain user data. Two primary attack vectors exist: (1) Secret extraction — injecting {"lc": 1, "type": "secret", "id": ["ENV_VAR"]} causes the deserializer to resolve and return the named environment variable when secrets_from_env=True (the old default); (2) Class instantiation — injecting constructor manifests to instantiate any Serializable subclass within trusted namespaces (langchain_core, langchain, langchain_community) with attacker-controlled parameters, potentially triggering side effects like network calls or file operations. The most common attack path is through LLM response fields such as additional_kwargs or response_metadata, which can be poisoned via prompt injection and then serialized/deserialized in streaming operations like astream_events(version="v1") or Runnable.astream_log() (GitHub Advisory, PR #34455).

Successful exploitation can lead to credential compromise (e.g., leaking OPENAI_API_KEY or other secrets stored in environment variables), unauthorized data access, and potentially remote code execution depending on which classes are available in the application's trusted namespaces. Because LLM responses can be manipulated via prompt injection to carry malicious lc-keyed payloads, the attack surface extends to any application that serializes and deserializes LLM outputs — including streaming pipelines, vector stores, message history handlers, and hub-pulled manifests. The scope of impact is broad given LangChain's widespread use in AI agent and RAG applications (GitHub Advisory, Feedly).

A public proof-of-concept exploit is available on GitHub (GitHub PoC) and the official advisory includes a working exploit example. No authentication or user interaction is required (network-accessible, unauthenticated). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.054% (low probability of near-term exploitation). The vulnerability is not currently listed in the CISA KEV catalog (Feedly).

1. Identify target: Locate a LangChain-based application (e.g., AI agent, RAG pipeline, chatbot) using langchain-core < 0.3.81 or 1.0.0–1.2.5 that serializes/deserializes LLM outputs or user-controlled data via dumps()/loads().
2. Craft malicious payload: Construct a dictionary with the lc key structure that mimics a LangChain internal object. For secret extraction: {"lc": 1, "type": "secret", "id": ["OPENAI_API_KEY"]}. For class instantiation: inject a constructor manifest targeting a class in langchain_core with attacker-controlled kwargs.
3. Inject via prompt injection or user-controlled field: Embed the malicious payload into an LLM prompt designed to make the model return the payload in additional_kwargs or response_metadata, or directly supply it through any user-controlled metadata field accepted by the application.
4. Trigger serialization: Cause the application to serialize the LLM response or user data using dumps() or dumpd(). In vulnerable versions, the lc key is not escaped, so the injected structure is preserved verbatim in the serialized output.
5. Trigger deserialization: Cause the application to deserialize the output via load() or loads() (e.g., through astream_events(version="v1"), astream_log(), RunnableWithMessageHistory, or InMemoryVectorStore.load()).
6. Extract secrets or trigger side effects: The deserializer resolves the injected secret marker against environment variables (if secrets_from_env=True) and returns the plaintext secret value, or instantiates the targeted class with attacker-controlled parameters, potentially making outbound network calls or performing file operations (GitHub Advisory).

• Application Logs: Unexpected deserialization of objects with type: secret or type: constructor in LangChain load/loads call traces; errors or warnings from langchain_core.load related to unknown object types.
• LLM Response Content: LLM outputs containing JSON structures with "lc": 1 keys in additional_kwargs or response_metadata fields — particularly if not expected from the model's normal output.
• Network: Unexpected outbound connections from the application server to unknown hosts, potentially triggered by class instantiation side effects during deserialization.
• Environment Variable Access: Unusual access patterns to sensitive environment variables (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY) in application runtime logs or OS-level audit logs.
• File System: Unexpected file reads or writes in directories accessible to the LangChain application process, potentially triggered by instantiated classes with file operation side effects.
• Serialized Data: Presence of {"lc": 1, "type": "secret", "id": [...]} or {"lc": 1, "type": "constructor", ...} structures in stored serialized data (e.g., vector store documents, message history, cache entries) that were not produced by the application itself (GitHub Advisory).

Upgrade immediately to patched versions: langchain-core 0.3.81+ or 1.2.5+ (for 1.0.0+ users), and langchain 0.3.81+ or 1.2.5+ (for 1.0.0+ users). The patch introduces three breaking changes to load()/loads(): (1) a new allowed_objects parameter defaulting to 'core' (restricts deserializable classes to a safe allowlist); (2) secrets_from_env now defaults to False; (3) a new init_validator parameter blocks Jinja2 templates by default. If immediate upgrade is not possible, disable secrets_from_env=True in all load()/loads() calls, avoid deserializing any data that may contain user-controlled or LLM-generated content, and restrict use of astream_events(version="v1") and astream_log(). IBM has also released iFixes for affected Cloud Pak for Business Automation and Business Automation Workflow products (GitHub Advisory, IBM Advisory).

The vulnerability received significant media and community attention under the nickname LangGrinch (disclosed around Christmas 2025). Coverage appeared in The Hacker News, Security Affairs, SiliconAngle, SC World, CyberSecurityNews, and TechRadar, among others (The Hacker News, Security Affairs, SiliconAngle). Microsoft published a case study on securing AI application supply chains referencing this vulnerability, and a Microsoft Security blog post titled "Breached in 86 seconds" highlighted how AI workloads can become credential dispensers (Microsoft Blog). The vulnerability trended on Hacker News and Reddit, with community discussion noting the particular danger of the prompt-injection-to-secret-exfiltration attack chain. Researchers from Cyata, Orca Security, and SOCRadar published detailed technical analyses (Cyata Blog, Orca Security, SOCRadar).