Threats Tagged 'cve-2025-68664'

Red Hat OpenShift Lightspeed is a generative AI-based virtual assistant integrated into the OpenShift console. It can answer questions related to OpenShift and layered offerings. Security Fix(es): langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.`

Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.

CVE-2025-68664 is a critical deserialization vulnerability in the LangChain framework versions prior to 0.3.81 and 1.2.5. The vulnerability arises because LangChain's dumps() and dumpd() serialization functions do not properly escape dictionaries containing the 'lc' key, which is internally used to mark serialized objects. Malicious actors can craft user-controlled data with this key to trigger unsafe deserialization, leading to potential remote code execution or unauthorized data manipulation. The vulnerability has a CVSS score of 9.3, indicating high severity with network attack vector, no privileges or user interaction required, and a scope change. European organizations using vulnerable LangChain versions in AI or agent-based applications face risks of confidentiality breaches and integrity violations.

CriticalVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-68664#cwe-502