LangGrinch: LangChain Core Serialization Injection

What to do

1. Upgrade Python langchain-core to 1.2.5 (1.x) or 0.3.81 (0.3.x): pip install -U 'langchain-core>=1.2.5'
2. Upgrade JS @langchain/core to 1.1.8 or 0.3.80 and langchain to 1.2.3 or 0.3.37
3. Move streaming code from astream_events(version="v1") to version="v2"
4. Do not re-enable secrets_from_env=True or disable the new allowed_objects / init_validator defaults on untrusted data
5. Rotate API keys held in environment variables of apps that deserialized model output on vulnerable versions

How to check if you are affected or compromised

• Run pip show langchain-core and npm ls @langchain/core langchain to find vulnerable versions, including transitive ones
• Grep code for load(, loads(, astream_log, astream_events(version="v1") and RunnableWithMessageHistory
• Search stored chat history, caches and logs for dictionaries containing "lc" with "type": "secret" that did not originate from your code

What happened#

On December 23, 2025, LangChain published GHSA-c67j-w6g6-q2cm (CVE-2025-68664), a serialization injection flaw in langchain-core, the base package under nearly every Python LangChain and LangGraph app. Cyata researcher Yarden Porat reported it on December 4 and nicknamed it "LangGrinch," according to The Hacker News.

LangChain marks its own serialized objects with a special "lc" key. The advisory explains that dumps() and dumpd() "do not escape dictionaries with 'lc' keys" when they serialize free-form data. If attacker-influenced content, such as an LLM response's additional_kwargs or response_metadata, contains an "lc" structure, a later load()/loads() treats it as a trusted LangChain object rather than plain data.

The advisory lists two main consequences:

• Secret extraction: with secrets_from_env=True, which was the old default, an injected "secret" object resolves to an environment variable, such as an API key, in the deserialized output.
• Object instantiation: the attacker can instantiate Serializable classes from the langchain_core, langchain and langchain_community namespaces with chosen parameters. That can trigger side effects such as network calls, and The Hacker News notes possible code execution through Jinja2 templates.

LangChain.js has a sibling flaw, CVE-2025-68665 (CVSS 8.6), in toJSON().

Who is affected#

According to the CVE record, Python langchain-core before 0.3.81 and 1.0.0 up to (not including) 1.2.5 are vulnerable. On the JS side, the affected packages are @langchain/core before 0.3.80 and 1.1.8, and langchain before 0.3.37 and 1.2.3.

The advisory names these exposed code paths: astream_events(version="v1"), Runnable.astream_log(), RunnableWithMessageHistory, InMemoryVectorStore.load(), hub.pull and MultiVectorRetriever. It states that astream_events(version="v2") is not vulnerable.

Do you really need to act?#

Yes, but not by dropping everything. The CVSS score is 9.3 (critical), and the package is everywhere. Still, an exploit needs three things:

1. Your app serializes data the attacker can shape. The most realistic route is prompt injection that makes the model emit an "lc"-shaped structure in its response metadata.
2. Your app later deserializes that data through one of the paths above.
3. For secret theft, secrets_from_env is enabled, which it was by default before the fix, and the attacker can see the output.

As of October 21, 2026, LangGrinch is not in CISA's KEV catalog, and none of the sources we reviewed report exploitation in the wild. The bigger risk is that a vulnerable langchain-core pinned as a transitive dependency survives for months. Treat it as a this-week dependency bump. Then check whether you deserialize model output anywhere; if you do, rotate the keys that process could read.

What to do now#

1. Upgrade: pip install -U "langchain-core>=1.2.5" (or >=0.3.81,<0.4 on the 0.3 line), then confirm with pip show langchain-core.
2. For JS, upgrade @langchain/core to 1.1.8 or 0.3.80 and langchain to 1.2.3 or 0.3.37, then check npm ls @langchain/core langchain.
3. Switch streaming code to astream_events(version="v2").
4. Expect breaking changes. The fix adds allowed_objects (default 'core'), flips secrets_from_env to False, and blocks Jinja2 templates through init_validator. Do not loosen these settings for untrusted data.
5. If a vulnerable app deserialized model output while holding provider keys in its environment, rotate those keys.

How to tell if you were hit#

There is no network signature for this. Look in stored message histories, caches and traces (LangSmith or similar) for {"lc": 1, "type": "secret", ...} or "type": "constructor" structures inside model responses or user fields. Also check provider dashboards for unexpected use of keys that the app's process could read.

Timeline#

• Dec 4, 2025: Yarden Porat (Cyata) reports the flaw to LangChain.
• Dec 23, 2025: GHSA-c67j-w6g6-q2cm and CVE-2025-68664 published; langchain-core 1.2.5 and 0.3.81 released. CVE-2025-68665 published for LangChain.js.
• Dec 26, 2025: Public coverage under the "LangGrinch" name.
• Oct 21, 2026: Not in CISA KEV; no in-the-wild exploitation reported in our sources.

Vulnerability records

• CVE-2025-68664 · LangChain is a framework for building agents and LLM-powered applications.
• CVE-2025-68665 · LangChain is a framework for building LLM-powered applications.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. GitHub (langchain-ai) — GHSA-c67j-w6g6-q2cm: LangChain serialization injection vulnerability github.com
2. CVE.org — CVE-2025-68664 record cve.org
3. CVE.org — CVE-2025-68665 record (LangChain.js) cve.org
4. CISA — Known Exploited Vulnerabilities catalog (JSON feed, checked 2026-10-21) cisa.gov

Coverage and analysis

1. The Hacker News — Critical LangChain Core vulnerability (LangGrinch) thehackernews.com