CVE-2025-68665

Executive Summary

CVE-2025-68665 is a critical deserialization injection vulnerability in the LangChain JavaScript framework, affecting both the @langchain/core package and the main langchain package. The flaw resides in the toJSON() method, which is invoked when serializing objects via JSON.stringify(). The method fails to properly escape or sanitize objects containing the lc key, a special internal marker used by LangChain to denote serialized LangChain objects. An attacker who can inject a crafted object with an lc key into the kwargs of a LangChain call can cause the deserialization process to treat the attacker-controlled data as a legitimate LangChain object, leading to arbitrary code execution or data manipulation. The vulnerability has a CVSS score of 8.6 (High) and is currently unpatched in older versions. No public proof-of-concept or exploit code has been released.

Supply Chain & Package Security

This vulnerability affects the npm ecosystem, specifically the @langchain/core and langchain packages. Organizations using these packages in their Node.js applications are at risk. The supply chain risk is elevated because the vulnerability is in a core serialization mechanism, meaning any application that processes user-supplied data through LangChain's serialization pipeline could be exploited. Developers should immediately audit their dependencies and update to the patched versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of sensitive data is possible.
• Integrity (I): High (H) – Complete compromise of data integrity is possible.
• Availability (A): High (H) – Full denial of service or system takeover is possible.

Threat Level: High. The combination of network exploitability, low complexity, and high impact makes this a critical vulnerability for any organization using LangChain JS.

Deep Dive & Mechanics

The vulnerability stems from the toJSON() method in LangChain JS. When an object is serialized using JSON.stringify(), the method recursively processes all properties. The lc key is a special internal marker that LangChain uses to identify serialized LangChain objects. During deserialization, the framework checks for the presence of the lc key and, if found, reconstructs the corresponding LangChain object.

The flaw is that the toJSON() method does not escape or sanitize user-controlled data that contains an lc key. If an attacker can inject a property with an lc key into the kwargs of a LangChain call, that property will be serialized as a legitimate LangChain object marker. When the serialized data is later deserialized, the framework will treat the attacker-controlled data as a valid LangChain object, potentially leading to arbitrary code execution or data manipulation.

For example, consider a LangChain application that accepts user input and stores it in a database. If the user input contains a JSON object with an lc key, that object will be serialized as a LangChain object. When the data is later retrieved and deserialized, the framework will attempt to reconstruct the object, potentially executing attacker-controlled code.

Vulnerable vs. Patched Code

Vulnerable Code (pre-patch):

// In the toJSON() method of LangChain objects
toJSON() {
  const result = {};
  for (const key of Object.keys(this)) {
    if (key === 'lc') {
      // No escaping or sanitization of user-controlled 'lc' key
      result[key] = this[key];
    } else {
      result[key] = this[key];
    }
  }
  return result;
}

Patched Code (post-patch):

// In the toJSON() method of LangChain objects
toJSON() {
  const result = {};
  for (const key of Object.keys(this)) {
    if (key === 'lc') {
      // Escape or sanitize the 'lc' key to prevent injection
      result['_lc_escaped'] = this[key];
    } else {
      result[key] = this[key];
    }
  }
  return result;
}

The patch renames the lc key to _lc_escaped during serialization, preventing the deserialization process from treating it as a legitimate LangChain object marker.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable LangChain JS application (version < 0.3.80 for @langchain/core or < 0.3.37 for langchain).
• Ability to inject arbitrary JSON into the kwargs of a LangChain call.

Exploitation Steps:

1. Identify an endpoint or function that accepts user input and passes it to a LangChain method that serializes the input.
2. Craft a malicious JSON payload that includes an lc key with a value that represents a dangerous LangChain object (e.g., a RunnableLambda that executes arbitrary code).
3. Send the payload to the vulnerable endpoint.
4. When the application serializes the payload, the lc key is preserved.
5. When the serialized data is later deserialized, the framework reconstructs the malicious LangChain object, leading to code execution.

Example Payload:

{
  "kwargs": {
    "lc": 1,
    "type": "constructor",
    "id": ["langchain_core", "runnables", "RunnableLambda"],
    "kwargs": {
      "func": "console.log('PWNED')"
    }
  }
}

Blue Team

Detection:

• Monitor for unusual JSON payloads containing the lc key in application logs.
• Use the YARA and Sigma rules provided in the Detection Engineering section.
• Implement input validation to reject any user input containing the lc key.

Mitigation:

• Immediately update to the patched versions: @langchain/core >= 0.3.80 or >= 1.1.8, and langchain >= 0.3.37 or >= 1.2.3.
• If patching is not possible, implement a Web Application Firewall (WAF) rule to block requests containing the lc key in JSON payloads.
• Conduct a thorough code review to identify all locations where user input is passed to LangChain serialization methods.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing JSON payloads with the lc key.
  • Unusual outbound connections from the application server to unknown IP addresses.
• File IOCs:
  • Log entries showing deserialization of objects with the lc key.
  • Unexpected files or processes created on the server.
• Behavioral IOCs:
  • Unusual CPU or memory spikes on the application server.
  • Unexpected API calls to LangChain methods.

Detection Engineering

YARA Rule

rule CVE_2025_68665_LangChain_Serialization_Injection {
  meta:
    description = "Detects serialized LangChain objects with malicious 'lc' key"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-68665"
  strings:
    $lc_key = /"lc"\s*:\s*\d+/ nocase
    $type_constructor = /"type"\s*:\s*"constructor"/ nocase
    $runnable_lambda = /"id"\s*:\s*\[.*"RunnableLambda".*\]/ nocase
  condition:
    all of them
}

Sigma Rule

title: CVE-2025-68665 LangChain Serialization Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing malicious LangChain serialization payloads
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: generic
detection:
  selection:
    c-uri|contains: 
      - 'lc'
      - 'RunnableLambda'
  condition: selection
falsepositives:
  - Legitimate use of LangChain serialization
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-68665 LangChain Serialization Injection"; flow:to_server; content:"lc"; http_client_body; content:"RunnableLambda"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update @langchain/core to version 0.3.80 or 1.1.8 (or later).
2. Update langchain to version 0.3.37 or 1.2.3 (or later).
3. If immediate patching is not possible, implement a WAF rule to block requests containing the lc key in JSON payloads.

Long-term Actions:

1. Conduct a security audit of all applications using LangChain JS.
2. Implement input validation and sanitization for all user-supplied data.
3. Monitor for any signs of exploitation using the provided detection rules.
4. Stay informed about future security advisories from LangChain.

Workaround:

• If patching is not possible, modify the application code to strip the lc key from user input before passing it to LangChain serialization methods.

Report generated by Valters IT DevSecOps & CTI Division