Read the docs
TI-2025-42158 Aliases CVE-2025-68665GHSA-r399-636x-v7f6

LangChain serialization injection vulnerability enables secret extraction

Priority HIGH 78CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00793 56th percentileScored 2026-11-07
Fix Partial @langchain/core (npm): 1.1.8, 0.3.80langchain (npm): 1.2.3, 0.3.37Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
langchain-ailangchainjs@langchain/core >= 1.0.0, < 1.1.8; @langchain/core < 0.3.80; langchain >= 1.0.0, < 1.2.3; langchain < 0.3.37—No fix listedCNA
—@langchain/core (npm)1.0.0 to before 1.1.81.1.8Patch availableGHSA-r399-636x-v7f6
—@langchain/core (npm)before 0.3.800.3.80Patch availableGHSA-r399-636x-v7f6
—langchain (npm)1.0.0 to before 1.2.31.2.3Patch availableGHSA-r399-636x-v7f6
—langchain (npm)before 0.3.370.3.37Patch availableGHSA-r399-636x-v7f6
  • langchainjs Vendorlangchain-ai Affected @langchain/core >= 1.0.0, < 1.1.8; @langchain/core < 0.3.80; langchain >= 1.0.0, < 1.2.3; langchain < 0.3.37 Fixed in — No fix listed CNA
  • @langchain/core (npm) Vendor— Affected 1.0.0 to before 1.1.8 Fixed in 1.1.8 Patch available GHSA-r399-636x-v7f6
  • @langchain/core (npm) Vendor— Affected before 0.3.80 Fixed in 0.3.80 Patch available GHSA-r399-636x-v7f6
  • langchain (npm) Vendor— Affected 1.0.0 to before 1.2.3 Fixed in 1.2.3 Patch available GHSA-r399-636x-v7f6
  • langchain (npm) Vendor— Affected before 0.3.37 Fixed in 0.3.37 Patch available GHSA-r399-636x-v7f6

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:langchain:langchain.js:*:*:*:*:*:*:*:*before 0.3.37; 1.0.0 to before 1.2.3Vulnerablelangchain-ai
cpe:2.3:a:langchain:langchain\/core:*:*:*:*:*:node.js:*:*before 0.3.80; 1.0.0 to before 1.1.8Vulnerablelangchain-ai
  • cpe:2.3:a:langchain:langchain.js:*:*:*:*:*:*:*:* Versions before 0.3.37; 1.0.0 to before 1.2.3 Vulnerable ·langchain-ai
  • cpe:2.3:a:langchain:langchain\/core:*:*:*:*:*:node.js:*:* Versions before 0.3.80; 1.0.0 to before 1.1.8 Vulnerable ·langchain-ai

Remediation

  • Fix · GHSA-r399-636x-v7f6 @langchain/core (npm) Fixed in 1.1.8 Advisory →
  • Fix · GHSA-r399-636x-v7f6 @langchain/core (npm) Fixed in 0.3.80 Advisory →
  • Fix · GHSA-r399-636x-v7f6 langchain (npm) Fixed in 1.2.3 Advisory →
  • Fix · GHSA-r399-636x-v7f6 langchain (npm) Fixed in 0.3.37 Advisory →

Red Hat 1 advisory

  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift LightspeedAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat OpenShift AI 3.3Fixed RHSA-2026:3713
Not affected: 4 products
  • Red Hat Ansible Automation Platform 2
  • Red Hat Enterprise Linux AI (RHEL AI)
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-68665
  2. 2026-10-03 Alias added: GHSA-r399-636x-v7f6

References

Patch 1

Advisory 2

Other 3

  • TI-2024-07207 Path Traversal in langchain-ai/langchainjs CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences