CVE-2025-65106: 
Python vulnerability analysis and mitigation

CVE-2025-65106 is a template injection vulnerability in LangChain's prompt template system (CWE-1336) that allows attackers to access Python object internals through template syntax. It affects langchain-core versions ≤0.3.79 and 1.0.0–1.0.6, and was disclosed on November 19–21, 2025. The vulnerability impacts applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. It carries a CVSS v4 base score of 8.3 (High) (GitHub Advisory, IBM Advisory).

The root cause (CWE-1336) differs by template format. For f-string templates, Python's string.Formatter().parse() extracts field expressions including attribute access syntax (e.g., msg.__class__.__name__), which were not validated to ensure they were simple identifiers — allowing traversal through object attributes and __globals__ dictionary lookups. For Mustache templates, the implementation used getattr() as a fallback when dict-key lookup failed, enabling attribute access on arbitrary Python objects. For Jinja2 templates, the default SandboxedEnvironment blocked dunder attributes but permitted access to other attributes and methods. Exploitation requires that an attacker control the template string itself (the structure), not merely the template variables (the data); applications with hardcoded templates are not affected (GitHub Advisory, Patch Commit).

Successful exploitation allows attackers to traverse Python object internals via attribute access (e.g., __class__, __globals__) and dictionary indexing, potentially exposing sensitive data such as environment variables, API keys, or other application secrets stored in the process context. The CVSS v4 scoring reflects high confidentiality impact and low integrity impact on the vulnerable system, with no availability impact. The practical severity is highest in applications that pass complex objects (e.g., MessagesPlaceholder with HumanMessage objects) to templates whose structure is user-controlled, as this enables deeper object graph traversal (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.045% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific precondition — the application must accept untrusted template strings, not just template variable values — which limits the attack surface to a subset of LangChain deployments (GitHub Advisory, IBM Advisory).

1. Identify a vulnerable target: Find a LangChain-powered application (running langchain-core ≤0.3.79 or 1.0.0–1.0.6) that accepts user-supplied template strings — for example, an API endpoint that takes a template parameter and passes it to ChatPromptTemplate.from_messages().
2. Craft a malicious template string: Construct a template that uses attribute traversal syntax appropriate to the template format in use:
   • F-string: {msg.__class__.__name__} or {msg.__globals__[os]}
   • Mustache: {{question.__class__.__name__}}
   • Jinja2: {{question.parse_raw}}
3. Submit the malicious template: Send the crafted template string to the application's template-accepting endpoint, along with any required template variables (e.g., {"msg": "foo", "msg.__class__.__name__": "safe_placeholder"} for f-string bypass).
4. Observe the response: The application renders the template and returns the resolved attribute value — for example, the class name of an internal object, or contents of __globals__ — leaking internal Python object state.
5. Escalate: Chain attribute access and dictionary indexing (e.g., {obj.__class__.__init__.__globals__[os]}) to reach environment variables or other sensitive runtime data (GitHub Advisory).

• Logs: Application logs showing template rendering errors such as ValueError: Invalid variable name (post-patch, indicating attempted exploitation against a patched system) or unexpected attribute values appearing in rendered prompt outputs.
• Network: HTTP requests to LangChain-backed API endpoints containing template syntax patterns such as .__class__, .__globals__, .__init__, or [os] in template string parameters.
• Application Behavior: Rendered prompt content containing Python class names (e.g., HumanMessage, str), module paths, or environment variable values that should not appear in normal output.
• File System / Config: Evidence of exfiltrated environment variables (e.g., API keys, database credentials) appearing in external requests or logs, suggesting successful traversal to __globals__.

Upgrade langchain-core to version 0.3.80 or 1.0.7 (or later), which apply the following fixes: f-string templates now validate that variable names are simple identifiers (rejecting . and [ syntax); Mustache templates restrict traversal to dict, list, and tuple types only (removing getattr() fallback); and Jinja2 templates use a new _RestrictedSandboxedEnvironment that blocks all attribute and method access. As an architectural workaround, ensure that users can only supply template variable values, never the template structure itself. For Jinja2 specifically, LangChain recommends using it only with trusted template sources regardless of patch status. Applications that do not need dynamic templates should construct messages directly using HumanMessage/AIMessage objects instead (GitHub Advisory, Patch Commit, IBM Advisory).

The vulnerability was credited to researcher 0xn3va and published as GitHub Security Advisory GHSA-6qv9-48xg-fc7f by LangChain maintainer eyurtsev on November 19, 2025. IBM subsequently issued a security bulletin noting that IBM watsonx Orchestrate Developer Edition is affected due to its use of LangChain as a dependency. The advisory notes that the Jinja2 hardening introduced in the initial patch was later reverted in langchain-core 1.1.3, as it broke legitimate Jinja2 usage without addressing a direct vulnerability — with the recommendation that Jinja2 templates remain restricted to trusted sources (GitHub Advisory, IBM Advisory).