CVE-2025-65106
LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerability exists in LangChain's prompt template system that allows attackers to access Python object internals through template syntax. This vulnerability affects applications that accept untrusted template strings (not just template variables) in ChatPromptTemplate and related prompt template classes. This issue has been patched in versions 0.3.80 and 1.0.7.
- Affected products
- Langchain
- Fix
- Available
- CVSS 4.0
- 8.3 HIGH
- EPSS
- 0.5% (40th percentile)
- Weakness
- CWE-1336
- NVD status
- Deferred
- Published
- 2025-11-21
CVE-2025-65106 at NVD
No indexed exploits for CVE-2025-65106 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2025-65106 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.