Search: CVE-2025-68664

CVE-2025-68664 is a critical deserialization vulnerability in the LangChain framework versions prior to 0.3.81 and 1.2.5. The vulnerability arises because LangChain's dumps() and dumpd() serialization functions do not properly escape dictionaries containing the 'lc' key, which is internally used to mark serialized objects. Malicious actors can craft user-controlled data with this key to trigger unsafe deserialization, leading to potential remote code execution or unauthorized data manipulation. The vulnerability has a CVSS score of 9.3, indicating high severity with network attack vector, no privileges or user interaction required, and a scope change. European organizations using vulnerable LangChain versions in AI or agent-based applications face risks of confidentiality breaches and integrity violations.