{"data":{"id":"2863efdd-86d2-4526-9521-7872ed934666","title":"CVE-2025-9556: Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library…","summary":"CVE-2025-9556 affects langchaingo, which supports jinja2 syntax in prompt parsing via the gonja library v1.5.3. Gonja's include and extends directives can read files, creating a server side template injection that lets an attacker insert a statement into a prompt to read the \"etc/passwd\" file.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9556","publishedAt":"2025-09-12T18:15:42.300Z","cveId":"CVE-2025-9556","cweIds":null,"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["langchaingo","gonja"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langchaingo server side template injection through prompt parsing","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00692,"epssCheckedAt":"2026-11-04T00:12:27.579Z","kevDateAdded":null,"advisoryAliases":["GHSA-v6f2-g4gw-r4rc"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:50.365Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}