Critical vulnerability in LangChain – CVE-2025-68664 • Hacker News Board

Re: Critical vulnerability in LangChain – CVE-2025-68664

#91

Post by peab » Sat, Dec 27, 2025, 3:08 AM UTC

stingraycharles wrote: post #90

peab wrote: post #87

Earlier quoted context omitted.

Because it tries to solve non existent problems (prompt templates for example) and adds complexity, instead of abstracting

Ok I agree with that, I think they had some weird idea of managing templates in LangSmith and then being able to load them dynamically from LangChain. LangSmith’s prompt engineering workflow is okay-ish but a lot of work and gets quite expensive quite fast, and only works for a specific set of prompts (ie one-turn prompts, multi-turn never works). PydanticAI seems more lightweight and gets out of the way.

Yes, Pydantic ai successfully abstracts the tool call loop, and makes it easy to test out different models.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#92

Post by int_19h » Sat, Dec 27, 2025, 9:29 AM UTC

gcr wrote: post #37

int_19h wrote: post #26

Earlier quoted context omitted.

I'll admit that I haven't looked it in a while, but as originally released, it was a textbook example on how to complicate a fundamentally simple and well-understood task (text templates, basically) with lots of useless abstractions that made it all sound more "enterprise". People would write complicated langchains, but then when you looked under the hood all it was doing is some string concatenation, and the result…

What do you suggest instead? Handrolled code with “import openai”? BAML?

For what LangChain does, yes, handrolled code. There won't be much of it because it doesn't actually do all that much.

As for "import openai", that's actually somewhat orthogonal, but if what you want is a common API for different providers then there are many options around that do just that. But then again at that point you probably also want something like OpenRouter, which has its own generic API.

Re: Critical vulnerability in LangChain – CVE-2025-68664

#93

Post by jmogly » Sun, Dec 28, 2025, 9:49 AM UTC

int_19h wrote: post #92

gcr wrote: post #37

Earlier quoted context omitted.

What do you suggest instead? Handrolled code with “import openai”? BAML?

For what LangChain does, yes, handrolled code. There won't be much of it because it doesn't actually do all that much. As for "import openai", that's actually somewhat orthogonal, but if what you want is a common API for different providers then there are many options around that do just that. But then again at that point you probably also want something like OpenRouter, which has its own generic API.

I’ve been using the following pattern since gpt3, the only other thing I have changed was added another parameter for schema for structured output. People really love to overcomplicate things.

class AI(Protocol):

def call_llm(prompt: str) -> str: …