{"id":"CVE-2025-65106","title":"langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates (CVE-2025-65106)","summary":"A template-injection vulnerability in LangChain's prompt template system allowed untrusted template strings to access Python object internals through attribute traversal and indexing. By crafting malicious template expressions, an attacker…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","cvssSource":"vendor","cwe":"CWE-1336","vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI)","affected":["openshift_lightspeed","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai","openshift_ai_rhoai"],"patched":["langchain-core 1.0.7","langchain-core 0.3.80"],"published":"2025-11-21","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:13:46+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65106.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65106.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-65106"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2416504"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-65106"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65106"},{"url":"https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a"},{"url":"https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00"},{"url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f"},{"url":"https://github.com/langchain-ai/langchain"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00524,"epssPercentile":0.44262,"aliases":["GHSA-6qv9-48xg-fc7f","PYSEC-2026-1518"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:46.518Z","slug":"CVE-2025-65106","body":"## Overview\n\nA template-injection vulnerability in LangChain's prompt template system allowed untrusted template strings to access Python object internals through attribute traversal and indexing. By crafting malicious template expressions, an attacker could read sensitive properties (e.g., __class__, __globals__) from objects passed into the template, potentially exposing environment variables, configuration data, and other confidential runtime state. The issue affects applications that accept user-controlled template structures rather than just template variables.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI), OpenShift Lightspeed, Red Hat Ansible Automation Platform 2 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65106.json)\n\n**langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates** — rated Important by Red Hat. Released 2025-11-21, updated 2026-10-15.\n\nAffected:\n\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI)\n- Red Hat OpenShift AI (RHOAI)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux AI (RHEL AI)\n- Red Hat OpenShift AI (RHOAI)\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n\nNot affected:\n\n- Red Hat Ansible Automation Platform 2\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nWill not fix\n\nWorkarounds / mitigations:\n\n- No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.\n\n## Package advisory (CVE-2025-65106)\n\nAffected packages:\n\n- `langchain-core >= 1.0.0, < 1.0.7`\n- `langchain-core < 0.3.80`\n\nPatched in:\n\n- `langchain-core 1.0.7`\n- `langchain-core 0.3.80`\n\nSource: https://osv.dev/vulnerability/GHSA-6qv9-48xg-fc7f","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222221,"id":"CVE-2025-65106","ts":1792065092020,"field":"cvss","old":null,"new":"8.2"}]}