CVE-2025-65106

LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.80 and 1.0.7.

CVSS

No CVSS.

References

Link	Resource
https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a
https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00
https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f

Configurations

No configuration.

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) LangChain es un framework para construir agentes y aplicaciones impulsadas por LLM. Desde las versiones 0.3.79 y anteriores, y de la 1.0.0 a la 1.0.6, existe una vulnerabilidad de inyección de plantillas en el sistema de plantillas de prompts de LangChain que permite a los atacantes acceder a los internos de objetos Python a través de la sintaxis de plantillas. Esta vulnerabilidad afecta a las aplicaciones que aceptan cadenas de plantillas no confiables (no solo variables de plantilla) en ChatPromptTemplate y clases de plantillas de prompts relacionadas. Este problema ha sido parcheado en las versiones 0.3.80 y 1.0.7.

Information

Published : 2025-11-21 22:16

Updated : 2026-10-19 13:10

NVD link : CVE-2025-65106

Mitre link : CVE-2025-65106

CVE.ORG link : CVE-2025-65106

JSON object : View

Products Affected

No product.

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2025-65106", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65106", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T21:53:02.259742Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "langchain-ai", "product": "langchain", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.0.7"}, {"status": "affected", "version": "< 0.3.80"}]}]}], "published": "2025-11-21T22:16:32.933", "references": [{"url": "https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a", "source": "security-advisories@github.com"}, {"url": "https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00", "source": "security-advisories@github.com"}, {"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.80 and 1.0.7."}, {"lang": "es", "value": "LangChain es un framework para construir agentes y aplicaciones impulsadas por LLM. Desde las versiones 0.3.79 y anteriores, y de la 1.0.0 a la 1.0.6, existe una vulnerabilidad de inyecci\u00f3n de plantillas en el sistema de plantillas de prompts de LangChain que permite a los atacantes acceder a los internos de objetos Python a trav\u00e9s de la sintaxis de plantillas. Esta vulnerabilidad afecta a las aplicaciones que aceptan cadenas de plantillas no confiables (no solo variables de plantilla) en ChatPromptTemplate y clases de plantillas de prompts relacionadas. Este problema ha sido parcheado en las versiones 0.3.80 y 1.0.7."}], "lastModified": "2026-10-19T13:10:00.110", "sourceIdentifier": "security-advisories@github.com"}