CVE-2025-68664

Classification basis

The script's primary purpose is to exercise the CVE-2025-68664 vulnerability by constructing a malicious payload, exploiting the unsafe deserialization, and executing an arbitrary system command ('id'). This constitutes an exploit.

Requirements

• The target application must use a vulnerable version of langchain-core (< 0.3.81 or >= 1.0.0, < 1.2.5) and call load() on attacker-controlled data.exploits/multiple/webapps/52514.py:9-13

Observed behavior

• The script constructs a dictionary payload containing an 'lc' key with a 'constructor' type that targets langchain_core.prompts.prompt.PromptTemplate.exploits/multiple/webapps/52514.py:23-34
• The payload's template is a Jinja2 expression that uses Python's built-in import function to execute the system command 'id'.exploits/multiple/webapps/52514.py:30
• The script serializes the payload using the vulnerable dumps() function.exploits/multiple/webapps/52514.py:37
• The script deserializes the payload using load(), which instantiates the malicious PromptTemplate object.exploits/multiple/webapps/52514.py:40
• The script invokes the deserialized PromptTemplate's format() method, which triggers the SSTI and executes the 'id' command.exploits/multiple/webapps/52514.py:43-44

Observables

Exploit Mechanism

Payload withheldThe payload uses a constructor type with id ['langchain_core', 'prompts', 'prompt', 'PromptTemplate'] and a Jinja2 template that calls payload withheld. This matches the described CVE-2025-68664 serialization injection.exploits/multiple/webapps/52514.py:23-34

Command Execution

Payload withheldThe injected template executes the 'id' command, a benign system information command commonly used in PoCs to demonstrate RCE.exploits/multiple/webapps/52514.py:30

Environment Variable

Payload withheldA dummy environment variable is set to demonstrate potential secret access, but it is not exfiltrated or used for harm. The comment on line 19 explains its purpose.exploits/multiple/webapps/52514.py:19-20

Classification basis

The artifact's primary executable component (payload withheld) is a payload generator that creates JSON strings for testing. It does not contain any code to send these payloads to a target, trigger deserialization, or otherwise exploit a vulnerability. The README describes the vulnerability and provides a version detection script. This is consistent with a scanner (code that checks for a vulnerability without exploiting it).

Requirements

• A target application using a vulnerable version of langchain-core (< 0.3.81 or >= 1.0.0 < 1.2.5) that deserializes user-controlled data containing the 'lc' key.README.md:164-170

Observed behavior

• Generates JSON payloads containing the 'lc' marker for secret extraction, SSRF, RCE, and file read attacks.langgrinch_fuzzer.py:54-240
• Lists available payloads by category and exports them to a JSON file.langgrinch_fuzzer.py:346-381
• Provides a version detection script to check if the installed langchain-core is vulnerable.README.md:420-464

Observables

Vulnerability Poc

Payload withheldThe entire repository is a PoC writeup and payload generator for the stated CVE.README.md:1-626langgrinch_fuzzer.py:1-406

Payload Generator

Payload withheldA Python script that generates and displays JSON payloads for the vulnerability. It does not execute the payloads or connect to any remote service.langgrinch_fuzzer.py:1-406

Author Attribution

Payload withheldThe author is identified in the README and source code. This is metadata and not a backdoor indicator.README.md:607langgrinch_fuzzer.py:9

Classification basis

The artifact is a blog post/writeup providing a technical analysis of payload withheld. It contains no executable exploit or scanner code. The author explicitly states 'Мы намеренно не публикуем здесь готовый эксплойт' (We intentionally do not publish a ready-to-use exploit here).

Requirements

• User-controlled data containing an 'lc' key must be serialized by dumps() or dumpd() and later deserialized by load() or loads().README.md:29-31
• The attacker must be able to influence fields like additional_kwargs or response_metadata, often via prompt injection.README.md:23

Observed behavior

• The document describes how an attacker can craft a dictionary with an 'lc' key to be treated as a legitimate LangChain object during deserialization, leading to secret extraction from environment variables or instantiation of objects from an allowlist.README.md:29-31README.md:107-121
• The writeup mentions a specific exfiltration path using ChatBedrockConverse to make a GET request with an attacker-controlled endpoint and an environment variable in a header.README.md:125-129
• The author states that a ready-to-use exploit is intentionally not published to give security teams time to patch.README.md:131

Observables

Vulnerability Disclosure

Payload withheldThe document describes a serialization injection vulnerability in LangChain's dumps()/dumpd() functions.README.md:1-265

Marketing Content

Payload withheldThe document includes promotional content for a security product called Cyata, describing its features for AI risk management.README.md:193-257