{"action":"Upgrade @langchain/core to 0.3.80 or later.","affected":[{"fixed":"1.1.8","introduced":"1.0.0"},{"fixed":"0.3.80","introduced":"0"}],"component":"@langchain/core","cve_ids":["CVE-2025-68665"],"ecosystem":"npm","epss":0.00793,"exploited":false,"fixed_versions":["1.1.8","0.3.80"],"ghsa_id":"GHSA-r399-636x-v7f6","id":"tcs_01M5KG7QZ0Q2GXD48EE3DV7AQD","modified_at":"2026-09-10T03:50:58.820101156Z","published_at":"2025-12-23T20:08:48Z","references":["https://osv.dev/vulnerability/GHSA-r399-636x-v7f6","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-r399-636x-v7f6","https://nvd.nist.gov/vuln/detail/CVE-2025-68665","https://github.com/langchain-ai/langchainjs/commit/e5063f9c6e9989ea067dfdff39262b9e7b6aba62","https://github.com/langchain-ai/langchainjs","https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcore%401.1.8","https://github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.3"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-r399-636x-v7f6","url":"https://osv.dev/vulnerability/GHSA-r399-636x-v7f6"}],"summary":"LangChain serialization injection vulnerability enables secret extraction"}