{"action":"Upgrade langchain to 0.3.37 or later.","affected":[{"fixed":"1.2.3","introduced":"1.0.0"},{"fixed":"0.3.37","introduced":"0"}],"component":"langchain","cve_ids":["CVE-2025-68665"],"ecosystem":"npm","epss":0.00793,"exploited":false,"fixed_versions":["1.2.3","0.3.37"],"ghsa_id":"GHSA-r399-636x-v7f6","id":"tcs_01M5KG7R7GGVJZWVRAARRXQJP4","modified_at":"2026-09-10T03:50:58.820101156Z","published_at":"2025-12-23T20:08:48Z","references":["https://osv.dev/vulnerability/GHSA-r399-636x-v7f6","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-r399-636x-v7f6","https://nvd.nist.gov/vuln/detail/CVE-2025-68665","https://github.com/langchain-ai/langchainjs/commit/e5063f9c6e9989ea067dfdff39262b9e7b6aba62","https://github.com/langchain-ai/langchainjs","https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcore%401.1.8","https://github.com/langchain-ai/langchainjs/releases/tag/langchain%401.2.3"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-r399-636x-v7f6#npm/langchain","url":"https://osv.dev/vulnerability/GHSA-r399-636x-v7f6"}],"summary":"LangChain serialization injection vulnerability enables secret extraction"}