# All I Want for Christmas Is Your Secrets: LangGrinch hits LangChain Core (CVE-2025-68664)

**URL:** <https://forum.devtalk.com/t/all-i-want-for-christmas-is-your-secrets-langgrinch-hits-langchain-core-cve-2025-68664/227793>\
**Category:** In The News\
**Tags:** via-news-bot, langchain, in-the-news\
**Created:** [26 December 2025 17:05 UTC](https://forum.devtalk.com/t/all-i-want-for-christmas-is-your-secrets-langgrinch-hits-langchain-core-cve-2025-68664/227793 "2025-12-26T17:05:41Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![CommunityNews](https://forum.devtalk.com/user_avatar/forum.devtalk.com/communitynews/32/1113_2.png) [@CommunityNews](https://forum.devtalk.com/u/CommunityNews)\
**Post date:** [26 December 2025 17:05 UTC](https://forum.devtalk.com/t/all-i-want-for-christmas-is-your-secrets-langgrinch-hits-langchain-core-cve-2025-68664/227793/1 "2025-12-26T17:05:41Z")

</div>

> Cyata discloses LangGrinch (CVE-2025-68664), a critical LangChain Core serialization injection bug where untrusted, LLM-influenced metadata can be rehydrated as objects, enabling secret leaks and unsafe instantiation. Patch guidance included.

Read in full here:

> **[All I Want for Christmas Is Your Secrets: LangGrinch hits LangChain Core...](https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/)**
>
> Cyata discloses LangGrinch (CVE-2025-68664), a critical LangChain Core serialization injection bug where untrusted, LLM-influenced metadata can be rehydrated as objects, enabling secret leaks and unsafe instantiation. Patch guidance included.