Critical LangChain Vulnerability Exposes API Keys and Sensitive Credentials

Cyberpress • December 26, 2025

Share: View original

A critical security flaw in LangChain, could allow attackers to extract sensitive environment variables and execute malicious code.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical LangChain Vulnerability Enables Secret Exfiltration A critical vulnerability in LangChain’s core library (CVE-2025-68664) was discovered, allowing attackers to exfiltrate sensitive environment variables and potentially execute code through deserialization flaws. The issue, affecting a widely used AI framework with hundreds of millions of downloads, was patched just before Christmas 2025. 6 sources 45

Extracted Entities

Companies (1)