MediumVulnerabilityLLM-specific
CVE-2025-65106: LangChain template injection via untrusted template strings
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2025-65106
- Published
- Record updated
- Affected
- langchain-core >= 1.0.0, <= 1.0.6, fixed in 1.0.7, released November 19, 2025, 3 days before disclosure
- langchain-core <= 0.3.79, fixed in 0.3.80, released November 19, 2025, 3 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
CVE-2025-65106 affects LangChain from versions 0.3.79 and prior and 1.0.0 to 1.0.6. A template injection flaw in its prompt template system lets attackers reach Python object internals through template syntax. The issue affects applications that accept untrusted template strings, not just template variables, in ChatPromptTemplate and related prompt template classes.
Mitigation
This issue has been patched in versions 0.3.80 and 1.0.7.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchain-corePyPILLM dependency since 2023-11-20 · 60 tracked dependents
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database