Cloudanix VulnDB

CVE-2025-65106

None

CVSS

—

EPSS

0.5%

Published

Nov 21, 2025

CISA due date

—

The record

LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.80 and 1.0.7.

Affected packages

Ecosystem Package Introduced Fixed
PyPI langchain-core 0 0.3.80
PyPI langchain-core 1.0.0 1.0.7
Chainguard open-webui 0 0.6.37-r0
Chainguard open-webui-compat 0 0.6.37-r0
Wolfi open-webui 0 0.6.37-r0
Wolfi open-webui-compat 0 0.6.37-r0
pypi langchain-core 1.0.0 No fix

Related vulnerabilities