LangChain Core serialization injection allows secret extraction (CVE-2025-68664)
CVE-2025-68664 is a critical serialization injection vulnerability in the LangChain Core Python package with a CVSS score of 9.3. It enables attackers to steal secrets and perform prompt injection via unsafe deserialization.
CVE-2025-68664 is a LangChain serialization injection flaw that enables secret extraction via unsafe deserialization.
Key facts
- What
- CVE-2025-68664 is a critical serialization injection vulnerability in the LangChain Core Python package with a CVSS score of 9.3.
- Incident date
- Dec 23, 2025
- Who
- LangChain
- Failure mode
- Prompt Injection
- AI surface
- Agentic Workflow
- Severity
- High
What happened
A critical serialization injection vulnerability, identified as CVE-2025-68664, was discovered in LangChain Core. The flaw allowed for the theft of secrets and prompt injection via unsafe deserialization. Updates were subsequently released to address the issue.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
The vulnerability was caused by unsafe deserialization processes within the LangChain Core Python package. This flaw allowed attackers to perform serialization injection, enabling the extraction of secrets.
What it cost
Sources
- PrimaryCVE-2025-68664: LangChain Serialization Injectionupwind.io
- PressCritical LangChain Core Vulnerabilitythehackernews.com
- PrimaryCVE-2025-68664-LangGrinch-PoCgithub.com
Cite this entry
https://failureindex.ai/failures/langchain-core-serialization-injection-allows-secretAI Failure Index. "LangChain Core serialization injection allows secret extraction (CVE-2025-68664)" (FI-0567). Realm Labs. https://failureindex.ai/failures/langchain-core-serialization-injection-allows-secret (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0567. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.