Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2025-68665

crítica

CVE-2025-68665

langchain-core: LangChain: Arbitrary Code Execution via Serialization Injection

Publicada Modificada CWE 502
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Red Hat8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta).

Descripción

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON() method (and subsequently when string-ifying objects using JSON.stringify(). The method did not escape objects with 'lc' keys when serializing free-form data in kwargs. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in @langchain/core versions 0.3.80 and 1.1.8, and langchain versions 0.3.37 and 1.2.3

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
chainguardkibana-8.17, kibana-8.18, kibana-8.19 y 6 más8.17.10-r6 y 7 más
echo npm::Echo OSV@langchain/core, langchain0.3.37
minimoskibana-8.19, kibana-9.2, kibana-9.38.19.15-r0 y 2 más
npm::GitHub Security Advisory npm@langchain/core, langchain1.1.8, 0.3.80 y 1 más
Mostrar las 16 entradas de 4 fuentes
FuentePaqueteCorregido en
chainguardkibana-8.178.17.10-r6
chainguardkibana-8.188.18.8-r6
chainguardkibana-8.198.19.9-r2
chainguardkibana-9.09.0.8-r5
chainguardkibana-9.19.1.9-r1
chainguardkibana-9.29.2.3-r1
chainguardlangfuse-22.95.12-r4
chainguardlangfuse-fips-22.95.12-r4
chainguardlibrechat0.8.1-r1
echo npm::Echo OSV@langchain/core0.3.37
echo npm::Echo OSVlangchain0.3.37
minimoskibana-8.198.19.15-r0
minimoskibana-9.29.2.5-r0
minimoskibana-9.39.3.4-r0
npm::GitHub Security Advisory npm@langchain/core1.1.8, 0.3.80
npm::GitHub Security Advisory npmlangchain1.2.3, 0.3.37

Referencias

Las 10 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.