Critical vulnerability in LangChain – CVE-2025-68664
1–10 of 93 posts
Re: Critical vulnerability in LangChain – CVE-2025-68664
#2CVE-2025-68664 (langchain-core): object confusion during (de)serialization can leak secrets (and in some cases escalate further). Details and mitigations in the post.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#3WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? I get dizzy when I see this AI slop style.
I would rather just read the original prompt that went in instead of verbosified "it's not X, it's **Y**!" slop.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#4WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? I get dizzy when I see this AI slop style. I would rather just read the original prompt that went in instead of verbosified "it's not X, it's **Y**!" slop.
> WHY on earth did the author of the CVE feel the need to feed the description text through an LLm?
Not everyone speaks English natively.
Not everyone has taste when it comes to written English.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#5WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? I get dizzy when I see this AI slop style. I would rather just read the original prompt that went in instead of verbosified "it's not X, it's **Y**!" slop.
> WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? Not everyone speaks English natively. Not everyone has taste when it comes to written English.
If I want to cleanup, summarize, translate, make more formal, make more funny, whatever, some incoming text by sending it through an LLM, I can do it myself.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#6The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#7The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Can you elaborate? Fairly new to langchain, but didn't realize it had any sort of stereotypical type of user.
Re: Critical vulnerability in LangChain – CVE-2025-68664
#8Cheers to all the teams on sev1 calls on their holidays, we can only hope their adversaries are also trying to spend time with family. LangGrinch, indeed! (I get it, timely disclosure is responsible disclosure)
Re: Critical vulnerability in LangChain – CVE-2025-68664
#9WHY on earth did the author of the CVE feel the need to feed the description text through an LLm? I get dizzy when I see this AI slop style. I would rather just read the original prompt that went in instead of verbosified "it's not X, it's **Y**!" slop.
you can use chatgpt to reverse the prompt
Re: Critical vulnerability in LangChain – CVE-2025-68664
#10The best part about this is that you know the type of people/companies using langchain are likely the type that are not going to patch this in a timely manner.
Can you elaborate? Fairly new to langchain, but didn't realize it had any sort of stereotypical type of user.
I am not sure what's the stereotype, but I tried using langchain and realised most of the functionality actually adds more code to use than simply writing my own direct API LLM calls.
Overall I felt like it solves a problem doesn't exist, and I've been happily sending direct API calls for years to LLMs without issues.