The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Critical vulnerability in LangChain – CVE-2025-68664
41–50 of 93 posts
Re: Critical vulnerability in LangChain – CVE-2025-68664
#42Earlier quoted context omitted.
No dig at you, but I take the average langchain user as one who is either a) using it because their C-suite heard about at some AI conference and had it foisted upon them or b) does not care about software quality in general. I've talked to many people who regret building on top of it but they're in too deep. I think you may come to the same conclusions over time.
Great insight that you wouldn’t get without HN, thank you! What would you and your peers recommend?
Re: Critical vulnerability in LangChain – CVE-2025-68664
#43The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#44Earlier quoted context omitted.
Not sure if it's a joke, but I don't think LLM is a bijective function.
If you had all the token probabilities it would be bijective. There was a post about this here some time back.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#45WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? I get dizzy when I see this AI slop style. I would rather just read the original prompt that went in instead of verbosified "it's not X, it's **Y**!" slop.
> WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? Not everyone speaks English natively. Not everyone has taste when it comes to written English.
If you use an LLM because you think you can’t write and communicate well, then if that’s true it means you’re feeding content that you already believe isn’t worthy of expressing your ideas to a machine that will drag your words even further what you intended.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#46What're the odds they've licenced the Grinch character for use on their company blog?
Re: Critical vulnerability in LangChain – CVE-2025-68664
#47LLM slop. At least one clear error (hallucination): "’Twas the night before Christmas, and I was doing the least festive kind of work: staring at serialization" Per disclosure timeline the report was made on December 4, it was definitely not the night before Christmas when you were doing the work then.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#48The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#49Earlier quoted context omitted.
> WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? Not everyone speaks English natively. Not everyone has taste when it comes to written English.
I personally find that text written by a human, even someone without a strong grasp of the language, is always preferable to read simply because each word (for better or worse) was chosen by a human to represent their ideas. If you use an LLM because you think you can’t write and communicate well, then if that’s true it means you’re feeding content that you already believe isn’t worthy of expressing your ideas to a m…
Re: Critical vulnerability in LangChain – CVE-2025-68664
#50The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.
I found the general premise of the tools (in particular LangGraph) to be solid. I was never in the position to use it (not my current area of work), but had I been I may have suggested building some prototypes with it.