High severity · published Nov 21, 2025
CVE-2025-65106
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
8.3
CVSS
0.5%
EPSS
No
On KEV
Description
LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.80 and 1.0.7.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langchain · langchain-ai
>= 1.0.0, < 1.0.7; < 0.3.80 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65106
github.com
https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a
github.com
https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00
github.com
https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f
More from langchain
8.2
CVE-2026-44843
LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
8.2
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
7.5
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
7.5
CVE-2024-58340
LangChain <= 0.3.1 MRKLOutputParser ReDoS
5.5
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders