LangChain Core 1.2.4 - SSTI/RCE

ExploitDBExploitDB exploitExploitEDB-52514

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that exploits CVE-2025-68664, a serialization injection vulnerability in LangChain Core. It constructs a malicious payload with an 'lc' key, uses the vulnerable dumps() function to serialize it, and then uses load() to deserialize it, which instantiates a PromptTemplate containing a Jinja2 Server-Side Template Injection (SSTI) payload. The script then invokes the template to achieve arbitrary command execution (RCE).

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the claimed CVE-2025-68664 SSTI/RCE vulnerability in LangChain Core. It constructs a malicious serialized payload, deserializes it, and triggers command execution via Jinja2 template injection. All actions are consistent with a standard exploit demonstration; no concealed backdoor, unrelated payload, or operator-directed harm is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarelangchain-core
Attack typesdeserialization of untrusted dataserver-side template injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary purpose is to exercise the CVE-2025-68664 vulnerability by constructing a malicious payload, exploiting the unsafe deserialization, and executing an arbitrary system command ('id'). This constitutes an exploit.

exploits/multiple/webapps/52514.py:1-47

Requirements

  • The target application must use a vulnerable version of langchain-core (< 0.3.81 or >= 1.0.0, < 1.2.5) and call load() on attacker-controlled data.exploits/multiple/webapps/52514.py:9-13

Observed behavior

  • The script constructs a dictionary payload containing an 'lc' key with a 'constructor' type that targets langchain_core.prompts.prompt.PromptTemplate.exploits/multiple/webapps/52514.py:23-34
  • The payload's template is a Jinja2 expression that uses Python's built-in import function to execute the system command 'id'.exploits/multiple/webapps/52514.py:30
  • The script serializes the payload using the vulnerable dumps() function.exploits/multiple/webapps/52514.py:37
  • The script deserializes the payload using load(), which instantiates the malicious PromptTemplate object.exploits/multiple/webapps/52514.py:40
  • The script invokes the deserialized PromptTemplate's format() method, which triggers the SSTI and executes the 'id' command.exploits/multiple/webapps/52514.py:43-44
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
SSTI via Jinja2 template in deserialized PromptTemplateThe payload uses a constructor type with id ['langchain_core', 'prompts', 'prompt', 'PromptTemplate'] and a Jinja2 template that calls os.system('id'). This matches the described CVE-2025-68664 serialization injection.exploits/multiple/webapps/52514.py:23-34
Command Execution
os.system('id')The injected template executes the 'id' command, a benign system information command commonly used in PoCs to demonstrate RCE.exploits/multiple/webapps/52514.py:30
Environment Variable
TEST_SECRET=secret_value_123A dummy environment variable is set to demonstrate potential secret access, but it is not exfiltrated or used for harm. The comment on line 19 explains its purpose.exploits/multiple/webapps/52514.py:19-20
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the static source code of the exploit script. The script was not executed, and its effectiveness against a live target is not verified.
  • The evidence does not include the target application or environment, so the exact context of the vulnerability (e.g., how user input reaches the load() function) is inferred from the CVE description and script comments.
  • Only the single Python file was reviewed; no external dependencies or network resources were inspected.
  • Binary files were flagged but not analyzed; none were present in this artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1