CVE-2025-68665: 
JavaScript vulnerability analysis and mitigation

CVE-2025-68665 is a serialization injection vulnerability in LangChain.js (the JavaScript/TypeScript implementation of LangChain) that allows attackers who control serialized data to extract environment variable secrets and instantiate arbitrary classes with attacker-controlled parameters. Disclosed on December 23, 2025, it affects @langchain/core versions before 0.3.80 and 1.0.0–1.1.7, and langchain (npm) versions before 0.3.37 and 1.0.0–1.2.2. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) per Feedly/NVD data, though the GitHub Advisory scores it 8.6 (High) with a scope-changed vector (GitHub Advisory).

The root cause (CWE-502: Deserialization of Untrusted Data) lies in the Serializable.toJSON() method, which failed to escape user-controlled objects containing lc keys within kwargs fields such as additional_kwargs, metadata, and response_metadata. The lc key is LangChain's internal marker for serialized objects; when unescaped attacker-controlled data containing this key structure is later passed to load(), it is treated as a legitimate LangChain object rather than plain user data. This enables two primary attack vectors: (1) secret extraction by injecting {"lc": 1, "type": "secret", "id": ["ENV_VAR"]} to read any environment variable when secretsFromEnv: true (which effectively defaulted to true), and (2) arbitrary class instantiation by injecting constructor structures targeting any class in the application's import maps, potentially triggering network calls or file operations. LLM responses in additional_kwargs can be manipulated via prompt injection, making this exploitable through the LLM response pipeline itself (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated remote attackers to exfiltrate sensitive environment variable secrets — including API keys (e.g., OPENAI_API_KEY), database credentials, and other secrets stored in the process environment — without any privileges. Attackers can also instantiate arbitrary classes within the application's import maps with controlled parameters, potentially triggering unauthorized network communications, file read/write operations, or other side effects. Applications using LangGraph checkpoints are also affected, as the serialization/deserialization path is shared. The combination of prompt injection via LLM responses and this deserialization flaw creates a chained attack path from user-supplied prompts to full credential exfiltration (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been confirmed as of the disclosure date (GitHub Advisory). The EPSS score is 0.046% (very low probability of near-term exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and no user interaction, and the most common attack vector — injecting malicious lc structures via LLM prompt injection into additional_kwargs — is realistic in production AI applications. The vulnerability was reported by multiple independent researchers (0xn3va, yardenporat353, VladimirEliTokarev, siewer), suggesting broad awareness (GitHub Advisory).

1. Identify target: Locate a Node.js application using @langchain/core < 0.3.80 or 1.0.0–1.1.7 (or langchain npm < 0.3.37 or 1.0.0–1.2.2) that serializes LangChain objects and later deserializes them with load() and secretsFromEnv: true.
2. Craft malicious payload: Construct a JSON object containing the LangChain secret marker structure targeting a desired environment variable:

{
  "user_data": {
    "lc": 1,
    "type": "secret",
    "id": ["OPENAI_API_KEY"]
  }
}

3. Inject via attack surface: Deliver the payload through one of the available injection points:
   • Prompt injection: Craft an LLM prompt that causes the model to return the malicious lc structure in additional_kwargs or response_metadata fields of its response.
   • Direct data injection: If the application accepts user-controlled metadata or kwargs fields, inject the structure directly.
4. Trigger serialization/deserialization cycle: The application serializes the LangChain object (via toJSON() / JSON.stringify()), embedding the unescaped attacker payload. When the application later calls load() on this serialized data, the injected structure is treated as a legitimate LangChain secret reference.
5. Extract secrets: With secretsFromEnv: true, the load() function resolves the injected secret reference by reading the named environment variable (e.g., OPENAI_API_KEY) and returning its value as part of the deserialized object, which the attacker can then observe via application output, error messages, or side channels (GitHub Advisory).

• Network: Unexpected outbound connections from the LangChain application server to attacker-controlled infrastructure, potentially triggered by class instantiation side effects via injected constructor structures.
• Logs: Application logs showing deserialization of objects with lc, type: "secret", and id fields originating from LLM responses or user-supplied metadata; errors from load() referencing unexpected environment variable names.
• LLM Response Content: LLM responses containing JSON structures with {"lc": 1, "type": "secret", "id": [...]} patterns in additional_kwargs or response_metadata fields, which may indicate prompt injection attempts.
• Application Behavior: Unexpected environment variable values appearing in application output, API responses, or logs; unusual class instantiation errors referencing import map entries not normally used in application flow.

Upgrade immediately to the patched versions: @langchain/core 0.3.80 or 1.1.8+, and langchain (npm) 0.3.37 or 1.2.3+, released December 22–23, 2025 (Core Release, LangChain Release). The patch introduces: (1) an escape mechanism in toJSON() that wraps user-controlled lc-keyed objects in {"__lc_escaped__": {...}}; (2) secretsFromEnv now explicitly defaults to false, with missing secrets throwing an error instead of silently returning null; (3) a new maxDepth parameter (default 50) to prevent DoS via deeply nested structures. As an immediate workaround if upgrading is not possible, explicitly set secretsFromEnv: false in all load() calls and provide secrets via the secretsMap parameter instead. Never populate importMap or optionalImportsMap from user-controlled input (GitHub Advisory).

The vulnerability, nicknamed "LangGrinch" by some researchers, received notable coverage given its relevance to AI application security. The Hacker News covered it as a critical vulnerability exposing secrets via serialization injection (The Hacker News). Security researchers at Amla Labs and Cyata published detailed technical analyses under the "LangGrinch" moniker, highlighting the prompt injection chaining aspect as particularly concerning for production AI systems (Amla Labs, Cyata). A researcher published a blog post titled "LangChain load is basically eval" drawing parallels to JavaScript's eval() function, which gained traction on Reddit's r/LangChain community. CISA included the vulnerability in its weekly vulnerability bulletin for the week of December 22, 2025 (CISA Bulletin).