CVE-2025-65106

LangChain, a framework for building agents and LLM-powered applications, prior to versions 0.3.81 and 1.2.5 has a serialization injection vulnerability in its dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data.

A vulnerability in LangChain version 0.0.194 allows remote code execution via the from_math_prompt and from_colored_object_prompt functions in the PALChain class. An attacker can inject malicious Python code through the eval mechanism.

An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.

Langchain version 0.0.171 is vulnerable to arbitrary code execution in the load_prompt function.

LangChain prior to 1.3.1 does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing it to be interpreted as a MongoDB query condition rather than a literal value. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation when histories are stored in a shared MongoDB collection.

Vulnerability in LangChain before versions 0.3.85 and 1.3.3. Older runtime code paths deserialize inputs/outputs using overly broad object allowlists, allowing an attacker to supply malicious constructor dictionaries and instantiate objects with dangerous arguments.

In LangChain before version 1.1.2, an SSRF vulnerability exists in HTMLHeaderTextSplitter.split_text_from_url(). Although the initial URL is validated, redirects are not checked, allowing an attacker to access internal network resources.

A vulnerability in LangChain prior to version 1.2.22 allows arbitrary file read via directory traversal or absolute path injection in prompt configurations. Attackers can use load_prompt() or load_prompt_from_config() to read files, limited only by file extensions (.txt, .json, .yaml).

A ReDoS vulnerability in LangChain up to version 0.3.1 exists in the MRKLOutputParser.parse() method. An attacker can supply crafted text (e.g., via prompt injection) causing excessive CPU consumption and parsing delays, leading to denial of service.

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify()). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs, so user-controlled data containing this key structure is treated as a legitimate LangChain object during deserialization rather than plain user data.