Live data from Hacker News

Critical vulnerability in LangChain – CVE-2025-68664

cyata.ai

81–90 of 93 posts

Re: Critical vulnerability in LangChain – CVE-2025-68664

#81
post #18

Earlier quoted context omitted.

> I prefer reading the LLM output for accessibility reasons. And that's completely fine! If you prefer to read CVEs that way, nobody is going to stop you from piping all CVE descriptions you're interested in through a LLM. However, having it processed by a LLM is essentially a one-way operation. If some people prefer the original and some others prefer the LLM output, the obvious move is to share the original with th…

Well, no. Because authors do two things typically when they use an LLM for editing: - iterate multiple rounds - approve the final edit as their message I can’t do either of those things myself — and your post implicitly assumes there’s underlying content prior to the LLM process; but it’s likely to be iterated interactions with an LLM that produces content at all — ie, there never exists a human-written rough draft o…

Thank you for your post, it's more elegant than my explanation and makes good arguments.

Sometimes I question my sanity these days when my (internally) valid thoughts seem to swoosh by externally.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#83
post #82

Earlier quoted context omitted.

Have you heard of `def`?

It was an earnest question. I didn’t intend to be sarcastic.

I went through evaluating a bunch of frameworks. There was Langchain, AG2, Firebase Gen AI / Vertex / whatever Google eventually lands on, Crew AI, Microsoft's stuff etc.

It was so early in the game none of those frame works are ready. What they do under the hood when I looked wasn't a lot. I just wanted some sort of abstraction over the model apis and the ability to use the native api if the abstraction wasn't good enough. I ended up using Spring AI. Its working well for me at the moment. I dipped into the native APIS when I needed a new feature (web search).

Out of all the others Crew AI was my second choice. All of those frameworks seem parasitic. One your on the platform you are locked in. Some were open source but if you wanted to do anything useful you needed an API key and you could see that features were going to be locked behind some sort of payment.

Honestly I think you could get a lot done with one of the CLI's like Claude Code running in a VM.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#84
post #82

Earlier quoted context omitted.

Have you heard of `def`?

It was an earnest question. I didn’t intend to be sarcastic.

Which abstractions in langchain do you find so useful which require significant code to replicate yourself in functions with OpenAI SDK / LiteLLM?

Re: Critical vulnerability in LangChain – CVE-2025-68664

#85

Earlier quoted context omitted.

What makes you say that? Because it’s popular?

Because it's shit.

Have you seen hamilton/burr python packages for building the state machines for llm work?

Re: Critical vulnerability in LangChain – CVE-2025-68664

#86
post #41

Earlier quoted context omitted.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

Curious what your critique is for LangChain? I found the general premise of the tools (in particular LangGraph) to be solid. I was never in the position to use it (not my current area of work), but had I been I may have suggested building some prototypes with it.

I think there are probably lots of thorough critiques, but for me it boiled down to this:

Langchain claimed to be an abstraction on top of LLMs, but in fact, added additional unecessary complexity.

Prompt management was such a buzzword when langchain came out, but 99% of LLM use cases don't need prompt management - GitHub and strings works just fine.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#87
post #41

Earlier quoted context omitted.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

What makes you say that? Because it’s popular?

Because it tries to solve non existent problems (prompt templates for example) and adds complexity, instead of abstracting

Re: Critical vulnerability in LangChain – CVE-2025-68664

#88
post #41

Earlier quoted context omitted.

Langchain is great because it provides you an easy method to filter people out when hiring. Candidates who talk about langchain are, more often than not, low quality candidates.

Would you say the same for Mastra? If so, what would you say indicates a high quality candidate when they are discussing agent harnessing and orchestration?

I'm not familiar with it. My first question would be: Are there any prominent projects that use it?

A lot of these frameworks are lauded, but if they were as good as they claim you would run into them in all sorts of apps. The only agents that i ever end up using are coding agents, i think they're obviously the most popular implementations of agents. Do they use langchain? No, i don't think so. They probably use in house logic cus it's just as easy and gives them more flexibility and less dependencies

Re: Critical vulnerability in LangChain – CVE-2025-68664

#89
post #62

Earlier quoted context omitted.

To this day many good models don't support structured outputs (say Opus 4.5) so it's not a panacea you can count on in production. The bigger problem is that LangChain/Python is the least set up to take advantage of strong schemas even when you do have it. Agree about pillaging for prompts though.

> so it's not a panacea you can count on in production. OpenAI and Gemini models can handle ridiculously complicated and convoluted schemas, if I needed complicated JSON output I wouldn’t use anything that didn’t guarantee it. I have pushed Gemini 2.5 Pro further than I thought possible when it comes to ridiculously over complicated (by necessity) structured output.

100% Gemini + pydantic you don’t need a wrapper library in 2025

Re: Critical vulnerability in LangChain – CVE-2025-68664

#90
post #87

Earlier quoted context omitted.

What makes you say that? Because it’s popular?

Because it tries to solve non existent problems (prompt templates for example) and adds complexity, instead of abstracting

Ok I agree with that, I think they had some weird idea of managing templates in LangSmith and then being able to load them dynamically from LangChain.

LangSmith’s prompt engineering workflow is okay-ish but a lot of work and gets quite expensive quite fast, and only works for a specific set of prompts (ie one-turn prompts, multi-turn never works).

PydanticAI seems more lightweight and gets out of the way.

Post reply on HN