Yüksek CVSS 8.2 PoC var
CVE-2025-68664: Langchain Core: güvenilmeyen verinin serileştirmeden çıkarılması
Açıklama (NVD)
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.
Özet bilgiler
- Ürün
- Langchain Langchain Core
- CVSS v3.1
- 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - EPSS
- %42,93 (yüzdelik 99)
- CWE
- CWE-502
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| langchain-langchain-core | — | — | 0.3.81 |
| langchain-langchain-core | 1.0.0 | — | 1.2.5 |