Deserialization of Untrusted Data in LangChain - CVE-2025-68664

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU120608

Deserialization of Untrusted Data in LangChain - CVE-2025-68664

Published: December 26, 2025


Vulnerability identifier: #VU120608
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-68664
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the dumps() and dumpd() functions. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

LangChain
watsonx.data
Automation Assets in IBM Cloud Pak for Integration (CP4I)
watsonx Code Assistant On Prem
Platform Navigator in IBM Cloud Pak for Integration (CP4I)

How to mitigate CVE-2025-68664

Install updates from vendor's website.

LangChain - addressed in versions 0.3.81, 1.2.5
watsonx.data - update to 2.3.1
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 4.3.1
watsonx Code Assistant On Prem - update to 5.3.1
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - update to 16.1.0.20

External References

Related Security Bulletins