Live data from Hacker News

Critical vulnerability in LangChain – CVE-2025-68664

cyata.ai

41–50 of 93 posts

Re: Critical vulnerability in LangChain – CVE-2025-68664

#41

The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#42

Earlier quoted context omitted.

No dig at you, but I take the average langchain user as one who is either a) using it because their C-suite heard about at some AI conference and had it foisted upon them or b) does not care about software quality in general. I've talked to many people who regret building on top of it but they're in too deep. I think you may come to the same conclusions over time.

Great insight that you wouldn’t get without HN, thank you! What would you and your peers recommend?

There's a great talk called Pydantic is all you need that i highly recommend

Re: Critical vulnerability in LangChain – CVE-2025-68664

#43
post #41

The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

It also helps with jobseeking as well. Easy to know which places to avoid.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#44
post #32
post #11

Earlier quoted context omitted.

Not sure if it's a joke, but I don't think LLM is a bijective function.

If you had all the token probabilities it would be bijective. There was a post about this here some time back.

Kind of, LLMs still use randomness when selecting tokens, so the same input can lead to multiple different outputs.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#45
post #3

WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? I get dizzy when I see this AI slop style. I would rather just read the original prompt that went in instead of verbosified "it's not X, it's **Y**!" slop.

> WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? Not everyone speaks English natively. Not everyone has taste when it comes to written English.

I personally find that text written by a human, even someone without a strong grasp of the language, is always preferable to read simply because each word (for better or worse) was chosen by a human to represent their ideas.

If you use an LLM because you think you can’t write and communicate well, then if that’s true it means you’re feeding content that you already believe isn’t worthy of expressing your ideas to a machine that will drag your words even further what you intended.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#47
post #35

LLM slop. At least one clear error (hallucination): "’Twas the night before Christmas, and I was doing the least festive kind of work: staring at serialization" Per disclosure timeline the report was made on December 4, it was definitely not the night before Christmas when you were doing the work then.

[deleted]

Re: Critical vulnerability in LangChain – CVE-2025-68664

#48
post #41

The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

Would you say the same for Mastra? If so, what would you say indicates a high quality candidate when they are discussing agent harnessing and orchestration?

Re: Critical vulnerability in LangChain – CVE-2025-68664

#49
post #45

Earlier quoted context omitted.

> WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? Not everyone speaks English natively. Not everyone has taste when it comes to written English.

I personally find that text written by a human, even someone without a strong grasp of the language, is always preferable to read simply because each word (for better or worse) was chosen by a human to represent their ideas. If you use an LLM because you think you can’t write and communicate well, then if that’s true it means you’re feeding content that you already believe isn’t worthy of expressing your ideas to a m…

Yeah. It feels like the same amount of signal for a larger amount of noise, and I strongly prefer high SNR. Terse and accurate are what I strive for in my writing, so it's painful to read a lot of text only to realize that two sentences would've sufficed.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#50
post #41

The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

Curious what your critique is for LangChain?

I found the general premise of the tools (in particular LangGraph) to be solid. I was never in the position to use it (not my current area of work), but had I been I may have suggested building some prototypes with it.

Post reply on HN