---
title: "LangGrinch: LangChain Core Serialization Injection"
url: https://erroneo.us/security/briefs/langgrinch-langchain-core-serialization-injection/
description: "CVE-2025-68664 lets 'lc'-shaped data leak env secrets via LangChain dumps/loads. Fixed in langchain-core 1.2.5/0.3.81. Patch this week; no exploitation known."
type: security-brief
section: "Security Digest"
date_published: 2025-12-23
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2025-68664", "CVE-2025-68665"]
severity: "critical"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# LangGrinch: LangChain Core Serialization Injection

**Verdict: Patch this week.** A real design flaw in a library almost every Python agent stack pulls in, but it needs a serialize-then-deserialize path over attacker-influenced data; bump langchain-core in your next routine dependency update.

- **Who must act:** Teams running LangChain apps that stream events with astream_events v1 or astream_log, persist message history, or load serialized objects that can contain LLM output or user data.
- **Who can relax:** Projects that never call LangChain's load()/loads() on data that could contain model output or user input, or that already run langchain-core 1.2.5+ or 0.3.81+.
- **Affected:** langchain-core >= 1.0.0, < 1.2.5; langchain-core < 0.3.81; @langchain/core >= 1.0.0, < 1.1.8 and < 0.3.80; langchain (npm) >= 1.0.0, < 1.2.3 and < 0.3.37
- **Fixed:** langchain-core 1.2.5; langchain-core 0.3.81; @langchain/core 1.1.8 / 0.3.80; langchain (npm) 1.2.3 / 0.3.37
- **CVEs:** CVE-2025-68664, CVE-2025-68665
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Upgrade Python langchain-core to 1.2.5 (1.x) or 0.3.81 (0.3.x): pip install -U 'langchain-core>=1.2.5'
2. Upgrade JS @langchain/core to 1.1.8 or 0.3.80 and langchain to 1.2.3 or 0.3.37
3. Move streaming code from astream_events(version="v1") to version="v2"
4. Do not re-enable secrets_from_env=True or disable the new allowed_objects / init_validator defaults on untrusted data
5. Rotate API keys held in environment variables of apps that deserialized model output on vulnerable versions

### How to check if you are affected

- Run pip show langchain-core and npm ls @langchain/core langchain to find vulnerable versions, including transitive ones
- Grep code for load(, loads(, astream_log, astream_events(version="v1") and RunnableWithMessageHistory
- Search stored chat history, caches and logs for dictionaries containing "lc" with "type": "secret" that did not originate from your code

## What happened

On December 23, 2025, LangChain published [GHSA-c67j-w6g6-q2cm](https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm) (CVE-2025-68664), a serialization injection flaw in `langchain-core`, the base package under nearly every Python LangChain and LangGraph app. Cyata researcher Yarden Porat reported it on December 4 and nicknamed it "LangGrinch," [according to The Hacker News](https://thehackernews.com/2025/12/critical-langchain-core-vulnerability.html).

LangChain marks its own serialized objects with a special `"lc"` key. The advisory explains that `dumps()` and `dumpd()` "do not escape dictionaries with 'lc' keys" when they serialize free-form data. If attacker-influenced content, such as an LLM response's `additional_kwargs` or `response_metadata`, contains an `"lc"` structure, a later `load()`/`loads()` treats it as a trusted LangChain object rather than plain data.

The advisory lists two main consequences:

- **Secret extraction:** with `secrets_from_env=True`, which was the old default, an injected "secret" object resolves to an environment variable, such as an API key, in the deserialized output.
- **Object instantiation:** the attacker can instantiate `Serializable` classes from the `langchain_core`, `langchain` and `langchain_community` namespaces with chosen parameters. That can trigger side effects such as network calls, and The Hacker News notes possible code execution through Jinja2 templates.

LangChain.js has a sibling flaw, [CVE-2025-68665](https://www.cve.org/CVERecord?id=CVE-2025-68665) (CVSS 8.6), in `toJSON()`.

## Who is affected

According to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-68664), Python `langchain-core` before 0.3.81 and 1.0.0 up to (not including) 1.2.5 are vulnerable. On the JS side, the affected packages are `@langchain/core` before 0.3.80 and 1.1.8, and `langchain` before 0.3.37 and 1.2.3.

The advisory names these exposed code paths: `astream_events(version="v1")`, `Runnable.astream_log()`, `RunnableWithMessageHistory`, `InMemoryVectorStore.load()`, `hub.pull` and `MultiVectorRetriever`. It states that `astream_events(version="v2")` is not vulnerable.

## Do you really need to act?

Yes, but not by dropping everything. The CVSS score is 9.3 (critical), and the package is everywhere. Still, an exploit needs three things:

1. Your app serializes data the attacker can shape. The most realistic route is prompt injection that makes the model emit an `"lc"`-shaped structure in its response metadata.
2. Your app later deserializes that data through one of the paths above.
3. For secret theft, `secrets_from_env` is enabled, which it was by default before the fix, and the attacker can see the output.

As of October 21, 2026, LangGrinch is not in [CISA's KEV catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json), and none of the sources we reviewed report exploitation in the wild. The bigger risk is that a vulnerable `langchain-core` pinned as a transitive dependency survives for months. Treat it as a this-week dependency bump. Then check whether you deserialize model output anywhere; if you do, rotate the keys that process could read.

## What to do now

1. Upgrade: `pip install -U "langchain-core>=1.2.5"` (or `>=0.3.81,<0.4` on the 0.3 line), then confirm with `pip show langchain-core`.
2. For JS, upgrade `@langchain/core` to 1.1.8 or 0.3.80 and `langchain` to 1.2.3 or 0.3.37, then check `npm ls @langchain/core langchain`.
3. Switch streaming code to `astream_events(version="v2")`.
4. Expect breaking changes. The fix adds `allowed_objects` (default `'core'`), flips `secrets_from_env` to `False`, and blocks Jinja2 templates through `init_validator`. Do not loosen these settings for untrusted data.
5. If a vulnerable app deserialized model output while holding provider keys in its environment, rotate those keys.

## How to tell if you were hit

There is no network signature for this. Look in stored message histories, caches and traces (LangSmith or similar) for `{"lc": 1, "type": "secret", ...}` or `"type": "constructor"` structures inside model responses or user fields. Also check provider dashboards for unexpected use of keys that the app's process could read.

## Timeline

- Dec 4, 2025: Yarden Porat (Cyata) reports the flaw to LangChain.
- Dec 23, 2025: GHSA-c67j-w6g6-q2cm and CVE-2025-68664 published; langchain-core 1.2.5 and 0.3.81 released. CVE-2025-68665 published for LangChain.js.
- Dec 26, 2025: Public coverage under the "LangGrinch" name.
- Oct 21, 2026: Not in CISA KEV; no in-the-wild exploitation reported in our sources.

## Sources

1. [GitHub (langchain-ai) — GHSA-c67j-w6g6-q2cm: LangChain serialization injection vulnerability](https://github.com/langchain-ai/langchain/security/advisories/GHSA-c67j-w6g6-q2cm)
2. [CVE.org — CVE-2025-68664 record](https://www.cve.org/CVERecord?id=CVE-2025-68664)
3. [CVE.org — CVE-2025-68665 record (LangChain.js)](https://www.cve.org/CVERecord?id=CVE-2025-68665)
4. [CISA — Known Exploited Vulnerabilities catalog (JSON feed, checked 2026-10-21)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
5. [The Hacker News — Critical LangChain Core vulnerability (LangGrinch)](https://thehackernews.com/2025/12/critical-langchain-core-vulnerability.html)

---
Source page: https://erroneo.us/security/briefs/langgrinch-langchain-core-serialization-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt