CVE-2025-68664

Three vulnerabilities in LangChain & LangGraph: path traversal flaw (CVE-2026-34070, CVSS 7.5) exposed files, deserialization bug (CVE-2025-68664, CVSS 9.3) leaked API keys. #security #LangChain #LangGraph

📢 𝐍𝐞𝐰 𝐂𝐕𝐄 𝐚𝐧𝐚𝐥𝐲𝐬𝐢𝐬 𝐣𝐮𝐬𝐭 𝐝𝐫𝐨𝐩𝐩𝐞𝐝! Uncover how CVE-2025-68664 exposes critical deserialization flaws in LangChain and LangGraph, risking data leaks and cloud exposure across AI deployments. 📖 Check th

🚨 BREAKING: Three critical flaws just dropped for LangChain & LangGraph — the AI frameworks powering millions of enterprise deployments. CVE-2025-68664 (CVSS 9.3): An attacker can use prompt injection to make your LLM exfiltrate your own API keys. https://t.co/GrBSYPpHc

TRC analysis shows attackers exploiting LangChain deserialization flaws to inject malicious data and access environment secrets (CVE-2025-68664). Initial compromise leads to credential theft, then lateral movement across cloud services. Runtime segmentation helps contain

🚨 LangChain重大脆弱性 CVE-2025-68664（CVSS 9.3）12の脆弱なフローで秘密情報漏洩・任意コード実行の可能性。LangChain.jsも影響。早急なパッチ適用を https://t.co/MJ1fEqufOP #LangChain #セキュリティ #脆弱性

CVE-2025-68664: ALERTA CRÍTICA POR INYECCIÓN DE SERIALIZACIÓN EN EL FRAMEWORK LANGCHAIN https://t.co/Er1JxJ1fw7

Clear the session, clear the threat. That assumption just failed. LangChain CVE-2025-68664 demonstrated how malicious instructions in LLM response fields persist through serialization cycles. One prompt injection in cached data becomes durable compromise. The instruction doesn't

CVE-2025-68664 (LangGrinch): LangChain deserializes LLM-influenced data as trusted objects. Prompt injection → secret leakage. We recreated 2000s serialization bugs, but with AI. "Autonomous agents" in prod without architecture review. A tutorial of what NOT to do.

Prompt security isn’t enough. LangGrinch (CVE-2025-68664) in langchain-core. Patch 0.3.81+ or 1.2.5+. Agent SDKs are Tier 1 deps. In your patch SLA? https://t.co/UuPcWRy84B #SupplyChainSecurity #Cybersecurity https://t.co/GC0yfT8E4X

A high-severity serialization injection vulnerability in langchain-core (CVE-2025-68664) enables secret extraction and malicious effects via an unescaped lc marker. Mitigations include patched upgrades and Defender integrations. #LangChain #AppSec https://t.co/bPdlcX2fwD

A serialization injection flaw (CVE-2025-68664, “LangGrinch”) in langchain-core Python package enables attackers to instantiate malicious objects via reserved lc key. Microsoft patches and detection tools available. #LangChain #SerializationFlaw https://t.co/25g2FJfxxW

🚨 Microsoft Case Study: LangGrinch (CVE-2025-68664) Shows How AI Framework Bugs Become Supply-Chain Exploits Microsoft breaks down “LangGrinch” (CVE-2025-68664, CVSS 9.3) in LangChain Core—a serialization/deserialization injection via the reserved `lc` marker that can l

🚨 [ ADVISORY ] CASE_LOG_001 AI output is UNTRUSTED input. LangGrinch (CVE-2025-68664) proves prompt injection = RCE. Sandbox your agents now. [ 🔻 LINK ] https://t.co/TW3Gg2Ma5B #CyberSecurityAwareness #artificial_intelligence https://t.co/y8Z68XYNPL

🚨 Critical RCE in LangChain Core (847M+ downloads) CVE-2025-68664 allows unsafe deserialization via LLM outputs, enabling secret exfiltration, SSRF, and potential RCE across common LangChain workflows. While most teams are still assessing impact and planning patches, Root ht

🚨 LangChain Core [—] Jan 05, 2026 Comprehensive Product Security Advisory and Risk Assessment for LangChain Core Serialization Injection Vulnerability (CVE-2025-68664) and Associated Agent System Risks. Checkout our Threat Intelligence Platform:... https://t.co/kk0AjBZt6m

Started publishing weekly roundups of what's happening in #AppSec world 🌎 🪏 MongoDB CVE that hit self-hosted instances 🪏 tokenless CSRF making it into OWASP guidance 🪏 OpenPGP implementation bugs. 🪏 LangChain CVE-2025-68664 🪏TruffleHog's JWT liveness checks.

⚠️ LangChain Core Vulnerability Allows Prompt Injection and Data Exposure (CVE-2025-68664) https://t.co/16fpPePCc4 A critical flaw in LangChain Core’s serialization functions (dumps()/dumpd()) lets attackers inject malicious object structures via prompt injection and uns

🚨 LangChain.js [—] Jan 03, 2026 Critical Security Advisory: CVE-2025-68664 LangChain Serialization Injection & Related Vulnerabilities Checkout our Threat Intelligence Platform: https://t.co/QuwNtEgYh1 https://t.co/QuwNtEgYh1 #ThreatIntelligence https://t.co/LcCl4WTpzf

Two critical vulnerabilities were published December 23, 2025 affecting LangChain Python (CVE-2025-68664, CVSS 9.3) and JavaScript (CVE-2025-68665, CVSS 8.6). Both are serialization injection flaws in dumps(), dumpd(), and toJSON() methods. The vulnerability: User-controlled

Two critical vulnerabilities were published December 23, 2025 affecting LangChain Python (CVE-2025-68664, CVSS 9.3) and JavaScript (CVE-2025-68665, CVSS 8.6). Both are serialization injection flaws in dumps(), dumpd(), and toJSON() methods. The vulnerability: User-controlled

este CVE-2025-68664 esta medio escondido entre la demas pila de cosas que hay para el fin de año. Langchain es un framework para desarrollos con AI y sus devs seguro lo han probado. critical serialization injection vulnerability affecting the LangChain framework

Warning: Multiple vulnerabilities in #LangChain. #CVE-2025-68664 CVSS: 9.3 #CVE-2025-68665 CVSS: 8.6. These are both serialization injection vulnerabilities. #Patch #Patch #Patch https://t.co/ljDdkgeamx

Your AI agent can leak your keys without anyone hacking you. Opinion: LLM output is untrusted input. Cost: one leak means rotated keys, blown budget, and a week of cleanup. Proof: LangChain CVE-2025-68664 (9.3 Critical). dumps()/dumpd() can treat a user dict with a reserved “l

🚨 LangChain Core Critical Flaw CVE-2025-68664 (CVSS 9.3) enables serialization injection, exposing secrets & enabling prompt-based attacks in LLM apps. 🔍 Details via Vulert 👉https://t.co/do7Wstb9Nh #LangChain #CVE #AISecurity #DevSecOps

LangChain Core has a critical bug that lets attackers extract secrets and steer LLM output. The issue, CVE-2025-68664 (CVSS 9.3), abuses how user data with lc keys is deserialized as trusted objects. Prompt injection can trigger it through normal LLM responses. https://t.co/fCmM

🚨 LangGrinch: Critical LangChain-Core Bug Enables Secret Theft via Serialization Injection (CVE-2025-68664) Attackers can inject crafted `lc`-key objects through user-influenced fields (e.g., `metadata`, `additional_kwargs`, `response_metadata`) so `dumps()/dumpd()` content is

🚨 Critical LangChain Serialization Injection Bug Exposes Secrets and May Enable Code Execution A critical flaw in langchain-core (CVE-2025-68664) lets attackers inject crafted “lc” structures so user-controlled data is treated as LangChain objects during deserialization,

🚨 Critical LangChain Flaw Lets Attackers Exfiltrate Secrets via Unsafe Deserialization A critical bug in langchain-core serialization (CVE-2025-68664) enables prompt/LLM-output–influenced data to trigger unsafe deserialization paths (e.g., logging/streaming/caching), leaking

How CVE-2025-68664 Allows Hackers to Siphon Your Private Data Directly from the vLLM Engine Read the full report on - https://t.co/9Aji9Icga9 https://t.co/NeYgkLm8Pj

🚨 Critical LangChain Core Vulnerability: "LangGrinch" (CVE-2025-68664, CVSS 9.3) 🚨 Prompt injection exploits a serialization flaw in dumps()/dumpd() — failing to escape the internal "lc" key lets tainted LLM output get deserialized as trusted objects. Result: Secret leaks

Critical LangChain Vulnerability (CVE-2025-68664) Puts LLM Apps at Risk #Cybersecurity #cyashadotcom #JanaNayaganAudioLaunch https://t.co/MoAsUFrqjj

CVE-2025-68664: patch LangChain now. Read More: https://t.co/XMxW6mlYZP #Sec #Vuln #Patch #LangChain #Sec #Vuln #Patch #LangChain

【LangChain CoreのCVE-2025-68664、修正版公開】 langchain-coreのdumps()/dumpd()で、ユーザー入力に含まれる予約キー「lc」が適切にエスケープされず、load()/loads()でLangChainオブジェクトとして扱われ得る脆弱性(CVE-2025-68664)

LangChain CVE-2025-68664 (CVSS 9.3) 🚨 ​Prompt Injection is now triggering Deserialization! 🤯 The game has changed. ​Hunters, are you fuzzing lc keys or doing deep Code Review for this? 👇 ​@rez0__ @zwt @nahamsec @Jhaddix @securibee @Rhynorater https://t.co/FZAIXRobD

Falha crítica no LangChain Core permite roubo de segredos e manipulação de respostas: Vulnerabilidade CVE-2025-68664 permite injeção de objetos via serialização, expondo dados sensíveis e possibilitando execuções maliciosas; atualização urgente é recomendada. https:/

All I Want for Christmas Is Your Secrets: LangGrinch hits LangChain Core (CVE-2025-68664) - Cyata | The Control Plane for Agentic Identity https://t.co/jpzB5SIQXB # #devtalk

🔍 𝐋𝐚𝐭𝐞𝐬𝐭 𝐂𝐕𝐄 𝐛𝐫𝐞𝐚𝐤𝐝𝐨𝐰𝐧 𝐚𝐯𝐚𝐢𝐥𝐚𝐛𝐥𝐞 𝐧𝐨𝐰! Is your LangChain app leaking secrets? Uncover how CVE-2025-68664 enables injection attacks and what steps you must take to secure your AI stack.

CVE-2025-68664 - Lord of the Strings: The Return of the 'lc' Key --- In the land of AI agents, so shiny and bright, LangChain was the framework that felt just right. One hundred twenty-three thousand stars in the sky, But nobody noticed the bug slipping by. --- The dumps()

Czy jesteś gotów na nową falę zagrożeń cyberbezpieczeństwa dla aplikacji AI? Nowo odkryta podatność w (CVE-2025-68664) osłabia aplikacje AI, umożliwiając kradzież danych i zdalne wykonanie kodu. Bądź na bieżąco! #LangChain #Cybersecurity #AI https://t.co/mjaRQ

Critical vulnerability in LangChain -- CVE-2025-68664: https://t.co/REzlUDGesF

A critical LangChain Core vulnerability (CVE-2025-68664) allows attackers to steal secrets and manipulate LLM behavior via serialization injection flaws. https://t.co/bY83uz78PC #CyberSecurity #LangChain #LLMSecurity #PromptInjection #AIThreats #AppSec #CloudSecurity https://t.

生成AIアプリ基盤として広く使われるLangChainの中核ライブラリに、秘密情報の窃取や応答改変につながる重大な欠陥が判明した(CVE-2025-68664)。巧妙な入力で内部処理を誤作動させ、LLMを攻撃者の意図通りに振る

#HuttonAIAlerts 🚨 Critical AI Vulnerability Alert 🚨 ​A CVSS 9.3 flaw (CVE-2025-68664) just hit LangChain. Attackers can now exfiltrate your system secrets and API keys via simple prompt injection. ​Your AI "brain" shouldn't be a security liability. (1/4) https://t.co/Y

LangChain Core has a critical bug that lets attackers extract secrets and steer LLM output. The issue, CVE-2025-68664 (CVSS 9.3), abuses how user data with lc keys is deserialized as trusted objects. Prompt injection can trigger it through normal LLM responses. 🔗 Read → ht

🚨Vulnerability Alert ‼️ Security researcher Yarden Porat discovered a vulnerability in LangChain that exploits how the framework handles internal serialization markers. The flaw, dubbed CVE-2025-68664, received a CVSS score of 9.3, indicating critical severity. Source:

All I Want for Christmas Is Your Secrets: LangGrinch hits LangChain Core (CVE-2025-68664) https://t.co/uidbKTMqUd

Today's top 5 cybersecurity news - December 26, 2025 1. A critical vulnerability identified as CVE-2025-68664 has been discovered in LangChain, a widely used AI framework, allowing attackers to extract sensitive environment variable secrets and potentially execute code through a

LangChain core vuln CVE-2025-68664 allowed env var exfiltration and possible code execution via deserialization flaws, patched just before Christmas 2025. Update now. #Vulnerability https://t.co/sbZrFg791Z

🚨 𝐖𝐞 𝐟𝐨𝐮𝐧𝐝 𝐚 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 𝐯𝐮𝐥𝐧𝐞𝐫𝐚𝐛𝐢𝐥𝐢𝐭𝐲 𝐢𝐧 𝐋𝐚𝐧𝐠𝐂𝐡𝐚𝐢𝐧. Upgrade to langchain-core 1.2.5 or 0.3.81 immediately. Cyata's security researcher Yarden Porat discovere

🛡️ Critical Langchain Vulnerability Let Attackers Exfiltrate Sensitive Secrets from AI systems Source: https://t.co/jcmomQRsvF A critical vulnerability in LangChain's core library (CVE-2025-68664) allows attackers to exfiltrate sensitive environment variables and potentia