Critical Langchain Vulnerability Let attackers Exfiltrate Sensitive Secrets from AI systems

Cybersecuritynews •Guru Baran • December 26, 2025

A critical vulnerability in LangChain’s core library (CVE-2025-68664) allows attackers to exfiltrate sensitive environment variables and potentially execute code through deserialization flaws. Discovered by a Cyata researcher and patched just before Christmas 2025, the issue affects one of the most popular AI frameworks with hundreds of millions of downloads. LangChain-core’s dumps() and dumpd() functions failed […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical LangChain Vulnerability Enables Secret Exfiltration A critical vulnerability in LangChain’s core library (CVE-2025-68664) was discovered, allowing attackers to exfiltrate sensitive environment variables and potentially execute code through deserialization flaws. The issue, affecting a widely used AI framework with hundreds of millions of downloads, was patched just before Christmas 2025. 6 sources 45

Extracted Entities

Critical Langchain Vulnerability Let attackers Exfiltrate Sensitive Secrets from AI systems

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

MITRE ATT&CK (1)