---
id: CVE-2025-65106
title: >-
  langchain-core: LangChain Vulnerable to Template Injection via Attribute
  Access in Prompt Templates (CVE-2025-65106)
summary: >-
  A template-injection vulnerability in LangChain's prompt template system
  allowed untrusted template strings to access Python object internals through
  attribute traversal and indexing. By crafting malicious template expressions,
  an attacker…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: vendor
cwe: CWE-1336
vendor: Red Hat
product: Red Hat Enterprise Linux AI (RHEL AI)
affected:
  - openshift_lightspeed
  - ansible_automation_platform 2
  - enterprise_linux_ai_rhel_ai
  - openshift_ai_rhoai
patched:
  - langchain-core 1.0.7
  - langchain-core 0.3.80
published: '2025-11-21'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:13:46+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65106.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65106.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-65106'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2416504'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-65106'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-65106'
  - url: >-
      https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a
  - url: >-
      https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00
  - url: >-
      https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f
  - url: 'https://github.com/langchain-ai/langchain'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00524
epssPercentile: 0.44262
aliases:
  - GHSA-6qv9-48xg-fc7f
  - PYSEC-2026-1518
ecosystem: pip
ingestedAt: '2026-07-08T18:25:46.518Z'
---

## Overview

A template-injection vulnerability in LangChain's prompt template system allowed untrusted template strings to access Python object internals through attribute traversal and indexing. By crafting malicious template expressions, an attacker could read sensitive properties (e.g., __class__, __globals__) from objects passed into the template, potentially exposing environment variables, configuration data, and other confidential runtime state. The issue affects applications that accept user-controlled template structures rather than just template variables.

## Vendor advisories

- **Red Hat VEX** · Important · affected: OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat Enterprise Linux AI (RHEL AI), Red Hat OpenShift AI (RHOAI), OpenShift Lightspeed, Red Hat Ansible Automation Platform 2 · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65106.json)

**langchain-core: LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates** — rated Important by Red Hat. Released 2025-11-21, updated 2026-10-15.

Affected:

- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux AI (RHEL AI)
- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat Enterprise Linux AI (RHEL AI)
- Red Hat OpenShift AI (RHOAI)
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2

Not affected:

- Red Hat Ansible Automation Platform 2
- Red Hat OpenShift AI (RHOAI)

## Remediation

Will not fix

Workarounds / mitigations:

- No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

## Package advisory (CVE-2025-65106)

Affected packages:

- `langchain-core >= 1.0.0, < 1.0.7`
- `langchain-core < 0.3.80`

Patched in:

- `langchain-core 1.0.7`
- `langchain-core 0.3.80`

Source: https://osv.dev/vulnerability/GHSA-6qv9-48xg-fc7f