High 2026-06-01

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

A vulnerability in LangChain (CVE-2025-65106) lets an attacker craft input to a prompt template that uses Python's attribute-access syntax (like object.__class__ or similar dunder chains) to escape the intended template variables and reach other objects in memory. This can let an attacker pull data or trigger behavior the template author never intended to expose.

How the attack works

An application builds a prompt using LangChain's template formatting and inserts user-controlled text into a template variable. Instead of supplying an ordinary value, the attacker supplies a string containing attribute-access syntax, such as chained dunder references, that Python's string formatting will resolve. LangChain's template engine evaluates that syntax during formatting, walking from the exposed object to other objects reachable through attributes. If those objects hold sensitive data or callables, the attacker can leak information or influence downstream behavior. This happens at the template-formatting step, before the resulting prompt is even sent to the model.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: b49de7aa-f5e5-47fb-a98a-946b40dd1595
Severity: High
CVEs: CVE-2025-65106

Classification

AML.T0051 · LLM Prompt Injection ASI01 · Agent Authorization and Control Hijacking LLM01 · Prompt Injection

Why it matters

An attacker with control over template input can read data or object state that was never meant to be part of the prompt, and in some cases affect application behavior, without needing model cooperation or a successful jailbreak.

What you can do

→Upgrade LangChain to a version that fixes GHSA-6qv9-48xg-fc7f / CVE-2025-65106.
→Never pass raw, unsanitized user input directly into prompt template variables; validate or escape it first.
→Avoid exposing rich Python objects (with sensitive attributes or methods) as template variables; pass only plain strings or scalars.
→Review logs for template inputs containing attribute-access patterns like double underscores or chained dots, and treat matches as suspicious pending review.