2025-12 · 2025-Q4

LangChain "LangGrinch" Serialization Injection

Primary layerL5 ConfigSecondary:L2 Instruction L1 Credential

Who wrote the file that runs on open?
The question layer 5 asks, and failed here.

Fixable: Vendor patch
Vendor response: Patched
In the wild: No
Actor: Attacker

Target

LangChain Core (before 0.3.81)

Impact

Secret exfiltration and potential RCE via LLM-influenced metadata containing reserved 'lc' key

Root cause

dumps()/dumpd() did not escape user-controlled dicts with reserved serialization marker

CVE

CVE-2025-68664

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: LangChain "LangGrinch" Serialization Injection (2025-12). https://agentprov.com/incidents/2025-12-langchain-langgrinch-serialization-injection

Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config