Lang Chain, Lang Graph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks
Summary: Researchers disclosed three vulnerabilities in LangChain and LangGraph that could expose filesystem data, environment secrets, and conversation history, with LangChain, LangChain-Core, and LangGraph downloaded more than 52 million, 23 million, and 9 million times on PyPI in the prior week alone. Cyera researcher Vladimir Tokarev said each flaw exposes a different class of enterprise data, and the issues have been patched in subsequent versions, with CVE-2025-68664 also detailed by Cyata in December 2025 under the name LangGrinch.
Why it matters: Cyera notes that hundreds of libraries wrap, extend, or depend on LangChain, so a flaw in its core ripples through every downstream library and integration that inherits the vulnerable code path - meaning patching your direct dependency may not cover everything built on top of it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-3248CVE-2025-68664CVE-2026-33017
- Related
- CVE-2026-33017: Langflow Code Injection Vulnerability Known Exploited Vulnerabilities · Mar 25, 2026