Three Vulnerabilities in LangChain and LangGraph Expose Files, API Keys, and Databases Across Millions of AI Deployments
Security researchers disclose a critical deserialization flaw and two high-severity bugs in the most widely downloaded AI framework on PyPI, with patches now available.
Overview
Security researchers at Cyera have disclosed three vulnerabilities in LangChain and LangGraph, a pair of open-source Python frameworks that together form one of the most widely used toolkits for building applications powered by large language models. The flaws, published on March 27, span three distinct attack classes — path traversal, unsafe deserialization, and SQL injection — and collectively expose filesystem data, environment secrets such as API keys, and conversation histories stored in databases, according to The Hacker News.
Patches are available for all three issues. Organizations running LangChain or LangGraph in production are urged to update immediately.
What We Know
The Scale of Exposure
LangChain, LangChain-Core, and LangGraph recorded more than 52 million, 23 million, and 9 million PyPI downloads respectively in the week preceding disclosure, as The Hacker News reported. The framework sits at the center of a large dependency ecosystem, meaning vulnerabilities ripple outward to downstream wrappers and integrations that inherit vulnerable code paths.
CVE-2025-68664: Serialization Injection (Critical)
The most severe of the three, rated 9.3 by GitHub and 8.2 by NIST, is a deserialization vulnerability in LangChain-Core. The dumps() and dumpd() functions do not escape dictionaries containing reserved lc keys when serializing free-form dictionaries, according to the National Vulnerability Database. Because LangChain uses the lc key internally to identify serialized objects, attacker-controlled input containing this marker is misinterpreted as a trusted LangChain object during deserialization. A payload as simple as {"lc": 1, "type": "secret", "id": ["OPENAI_API_KEY"]} can resolve to the actual value of the corresponding environment variable.
The flaw affects all LangChain-Core versions before 0.3.81 and versions 1.0.0 through 1.2.4. It is patched in versions 0.3.81 and 1.2.5, according to the NVD entry.
CVE-2026-34070: Path Traversal (High)
A path traversal vulnerability in legacy load_prompt functions within langchain_core/prompts/loading.py allows attackers to read files outside intended directories using specially crafted input, as TechRadar reported. The functions read files from paths embedded in deserialized configuration dictionaries without validating against directory traversal or absolute path injection. An attacker sharing a malicious prompt template can extract Docker configurations, cloud credentials, and other sensitive files in JSON, YAML, or TXT formats.
This vulnerability carries a CVSS score of 7.5 and is fixed in LangChain-Core version 1.2.22 and later.
CVE-2025-67644: SQL Injection (High)
The third flaw targets LangGraph’s SQLite checkpoint implementation. The _metadata_predicate() function parameterizes filter values but interpolates filter keys directly into SQL queries using f-strings, with no validation of allowed key names, according to The Hacker News. An attacker who controls metadata filter keys in checkpoint search operations can manipulate queries to access conversation histories and workflow state data stored in the database.
Scored at 7.3, this issue is resolved in langgraph-checkpoint-sqlite version 3.0.1.
What We Don’t Know
- Whether any of the three flaws have been exploited in the wild. None of the disclosures mention confirmed active exploitation, though the researchers noted that a related AI framework vulnerability — Langflow’s CVE-2026-33017 — was exploited within 20 hours of public disclosure, as The Hacker News reported.
- How many production deployments remain unpatched. The vulnerable
load_promptfunctions are deprecated legacy APIs, but organizations with older codebases may still rely on them. - Whether additional downstream packages that depend on LangChain-Core have introduced their own exposure through the inherited serialization behavior.
Analysis
The three flaws are notable not for their novelty but for their ordinariness. Path traversal, SQL injection, and unsafe deserialization are among the oldest and best-understood vulnerability classes in application security, classified under CWE-22, CWE-89, and CWE-502 respectively. Their presence in the most widely downloaded AI framework on PyPI underscores a tension in the current AI infrastructure boom: frameworks that handle sensitive data — prompts, API keys, conversation logs, and enterprise documents — are being deployed at a pace that outstrips the security maturity of their codebases.
The serialization injection flaw is particularly instructive. LangChain’s internal use of the lc key as a type marker creates a class of vulnerability where the boundary between trusted metadata and untrusted user input collapses during round-trip serialization. In agentic workflows where LLM outputs feed back into framework functions, this kind of confusion between data and control flow represents a systemic risk.
Organizations using LangChain or LangGraph should update to the patched versions immediately and audit any code that passes external configurations to load_prompt_from_config() or deserializes untrusted data with secrets_from_env enabled.