Three LangChain Flaws Leak Files, API Keys, Chat History
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Cyera disclosed three vulnerabilities in LangChain and LangGraph, each exposing a different data class: filesystem files, environment secrets, and conversation history, per researcher Vladimir Tokarev.
- CVE-2025-68664, a deserialization flaw in LangChain scored 9.3 on CVSS, allows attackers to pass a crafted data structure that the framework interprets as a serialized object, leaking API keys and environment secrets; Cyata publicly disclosed the same bug in December 2025 under the name LangGrinch.
- CVE-2026-34070 (CVSS 7.5) is a path traversal in
langchain_core/prompts/loading.pythat reads arbitrary files with no validation via a specially crafted prompt template, while CVE-2025-67644 (CVSS 7.3) is a SQL injection in LangGraph's SQLite checkpoint implementation that lets attackers run arbitrary SQL through metadata filter keys. - Patches have shipped in langchain-core ≥1.2.22 (CVE-2026-34070), langchain-core 0.3.81 and 1.2.5 (CVE-2025-68664), and langgraph-checkpoint-sqlite 3.0.1 (CVE-2025-67644).
- LangChain's reach is massive: PyPI logged more than 52 million LangChain, 23 million langchain-core, and 9 million LangGraph downloads in the week prior, and Cyera warned vulnerabilities in core 'ripple outward through every downstream library, every wrapper, every integration.'
- Langflow precedent: a critical flaw in the related Langflow framework (CVE-2026-33017, CVSS 9.3) was actively exploited within 20 hours of public disclosure, underscoring how fast attackers move against newly disclosed AI-framework bugs, according to Horizon3.ai's Naveen Sunkavally.
Why it matters: LangChain sits at the center of the AI-agent stack — Cyera notes hundreds of libraries depend on or wrap it — so a CVSS 9.3 deserialization flaw with a 52M-weekly-download surface area turns any unpatched enterprise deployment into a target for API-key and conversation-history theft. With Langflow's similar bug exploited within 20 hours of disclosure, the patching window for these three CVEs is effectively days, not weeks.
Ask SkimNews
