CVE-2025-65106High· 8.2▾ TwilightA template-injection vulnerability in LangChain's prompt template system allowed untrusted template strings to access Python object internals through attribute traversal and indexing. By crafting malicious template expressions, an attacker…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
Last analysed / modified upstream
— → 8.2
0.5% → 0.5%
A template-injection vulnerability in LangChain's prompt template system allowed untrusted template strings to access Python object internals through attribute traversal and indexing. By crafting malicious template expressions, an attacker could read sensitive properties (e.g., class, globals) from objects passed into the template, potentially exposing environment variables, configuration data, and other confidential runtime state. The issue affects applications that accept user-controlled template structures rather than just template variables.
langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates — rated Important by Red Hat. Released 2025-11-21, updated 2026-10-15.
Affected:
No fix planned:
Not affected:
Will not fix
Workarounds / mitigations:
Affected packages:
langchain-core >= 1.0.0, < 1.0.7langchain-core < 0.3.80Patched in:
langchain-core 1.0.7langchain-core 0.3.80Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-6985High· 7.5langchain-text-splitters: XXE Vulnerability in langchain-text-splitters (CVE-2025-6985)
CVE-2025-48956High· 7.5vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests (CVE-2025-48956)
CVE-2024-47874High· 7.5starlette: Starlette Denial of service (DoS) via multipart/form-data (CVE-2024-47874)
CVE-2025-27516High· 7.3jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)
CVE-2025-53643Low· 3.7aiohttp: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643)
CVE-2025-62426Medium· 6.5vllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` (CVE-2025-624…