CVE-2025-65106: LangChain Template Injection Vulnerability in Prompt Templates
Summary
CVE-2025-65106: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates. Affects langchain-core across 2 version ranges.
< 0.3.80
>= 1.0.0, < 1.0.7
Fixed in 0.3.80 or 1.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LangChain is an open-source framework designed for building applications that utilize language models. It provides a flexible prompt template system that allows developers to create dynamic prompts for chatbots and other applications. However, it has been found to be vulnerable to template injection attacks, particularly when untrusted template strings are accepted, which can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability in LangChain arises from its prompt template system, which allows for attribute access and indexing in template strings. This can be exploited by attackers who control the template strings, enabling them to access internal properties of Python objects. For instance, using attribute traversal, attackers can extract sensitive information such as class names or even environment variables. The vulnerability is particularly severe when applications accept template strings from untrusted sources, as this can lead to significant data exposure and potential escalation of attacks.
How To Fix
Latest published version: 1.7.0 as of 22 Oct 2026
pip install --upgrade "langchain-core==1.7.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.3.800.3.80pip install --upgrade "langchain-core==0.3.80" -
>= 1.0.0, < 1.0.71.0.7pip install --upgrade "langchain-core==1.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not possible, consider restricting the use of template strings to only those that are hardcoded in your application. Avoid accepting template strings from user input or any untrusted sources. For example, use the following code to ensure that the template is hardcoded:
prompt = ChatPromptTemplate.from_messages(
[("human", "User question: {question}")], # SAFE
template_format="f-string"
)
result = prompt.invoke({"question": user_input})
Conclusion
The LangChain template injection vulnerability (CVE-2025-65106) poses a significant risk to applications that utilize untrusted template strings. It is crucial for developers to update to the patched versions of 'langchain-core' and to implement best practices for template usage to mitigate this risk.
See every vulnerability recorded for langchain-core →
FAQ
The vulnerability allows attackers to exploit template strings to access sensitive internal properties of Python objects through attribute traversal.
If your application accepts template strings from untrusted sources or dynamically constructs prompt templates based on user input, it may be vulnerable.
Restrict the use of template strings to hardcoded values and avoid accepting user-provided template structures.
Attackers could extract sensitive information from your application, leading to data breaches or further exploitation.
Vulert monitors and alerts for open-source vulnerabilities in your software using the Pipfile.lock, allowing you to assess your application's exposure without needing to access the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-core.
