ExploitPublished
LangChain Core 1.2.4 · SSTI/RCE
Source Exploit-DB RSS Feed
0
Mentioned vulnerabilities
Severity
CriticalRated by Threat Radar
Data as of 5 May 2026, 07:48 UTC
What to do
AI-suggested
Until an official fix is available, avoid deserializing untrusted data with langchain_core.load and restrict usage of PromptTemplate with untrusted input. Monitor vendor channels for updates and apply patches promptly once released.
Description
LangChain Core 1.2.4 - SSTI/RCE
Indicators of compromise
Exploit source code
# Exploit Title: LangChain Core - SSTI/RCE
# Date: 2025-12-29
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Contact: @banyamer_security (Instagram)
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.langchain.com/
# Software Link: https://pypi.org/project/langchain-core/
# Version: < 0.3.81 and < 1.2.5
# Tested on: Python 3.10 - 3.12
# CVE : CVE-2025-68664
# Description: Exploits unsafe deserialization in langchain_core.load to instantiate a malicious …References
Community reviews
Loading reviews…