LangChain JS CVE-2025-68665

Exploitation requires an application that (1) constructs LangChain Serializable objects embedding user-controlled free-form data in kwargs fields such as additional_kwargs, metadata, or response_metadata, (2) serializes them via toJSON()/JSON.stringify(), and (3) later deserializes that output with load(). The most damaging outcomes are further gated: secret extraction requires the pre-patch secretsFromEnv behavior (which had no explicit default, effectively true), and arbitrary class instantiation requires the target class to be present in the configured importMap/optionalImportsMap. Limiting factors: applications that never call load() on untrusted or user-derived serialized data are not realistically exploitable, and the set of instantiable classes is bounded by the import maps the application explicitly provides. Affects @langchain/core < 0.3.80 and >=1.0.0 <1.1.8, and langchain < 0.3.37 and >=1.0.0 <1.2.3 on Node.js.

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N, score 9.1) presents this as a critical, network-exploitable, unauthenticated flaw with high confidentiality and integrity impact. However, these raw signals overstate the practical risk because exploitation is strongly conditional on application design: the host application must serialize user-controlled Serializable objects via toJSON()/JSON.stringify() and later feed that output back through load(). The most severe outcomes (secret extraction, arbitrary class instantiation) further require secretsFromEnv behavior to be enabled and attacker-reachable classes to be present in the configured import maps - so the ~AC:L rating is optimistic for most real deployments. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the input. Per precision rules, there is no public exploit identified at time of analysis and no evidence of active exploitation, so this is best treated as a high-severity library defect requiring patching rather than an emergency in-the-wild threat. Exploitation also demands a specific round-trip serialize-then-deserialize data flow, which limits who is genuinely exposed; teams not calling load() on untrusted serialized data are not practically affected.

An attacker submits data into a user-controlled field such as message metadata, additional_kwargs, or response_metadata containing a crafted object with an 'lc' key structure. The application serializes the LangChain object with JSON.stringify() and later rehydrates it with load(), at which point the injected structure is treated as a legitimate LangChain object - enabling environment-variable secret extraction (when secretsFromEnv is effectively enabled) or instantiation of an attacker-chosen class from the import map with attacker-controlled constructor kwargs. No public exploit code was identified at time of analysis.