High

LangChain Prompt Template Arbitrary File Read

LangChain's multimodal prompt templates can load an image file from a path and embed it in the prompt sent to a model. If an attacker controls the input value used for that path, they can point it at sensitive files instead of an image, and the file contents get read off the server and surfaced through the model's output.

How the attack works

LangChain's ImagePromptTemplate/ChatPromptTemplate accepts a 'path' key inside an image_url content block and reads that file from the local filesystem, base64-encoding it into the rendered prompt. An attacker supplies an input variable that resolves to a sensitive path (/etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials, mounted Kubernetes service-account tokens, .env files) or uses path-traversal sequences to escape an intended directory. When the template is rendered, the file is read and embedded in the prompt content, which the model may then echo back or otherwise expose. The detection fires only when the vulnerable template API is used together with a sensitive-path or traversal target in the same payload.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
b7f3c1d2-8a4e-4f6b-9c2d-5e17a3d90f42
Severity
High

Why it matters

An attacker can exfiltrate credentials, private keys, environment secrets, or other server-side files that the application process can read, without needing separate filesystem access.

What you can do

  • →Never let user-supplied input populate the 'path' field of an image prompt template directly; validate and allowlist file locations instead.
  • →Run the agent process with a restricted filesystem view or minimal read permissions so it cannot reach credentials, SSH keys, or mounted secrets.
  • →Reject or sanitize path-traversal sequences (../, absolute paths, symlinks) before they reach the template renderer.
  • →Review existing chains for any ImagePromptTemplate usage that accepts a caller-controlled path and add explicit path validation.

Known benign look-alikes

  • Developer authoring or debugging a multimodal langchain chain who pastes a real home-directory path that happens to sit under a dotfile directory (e.g. an image stored in ~/.config/) into an ImagePromptTemplate.
  • Security engineer or SOC analyst asking the agent to review the langchain-core image prompt template advisory — mostly suppressed by filter_security_writeup.
  • langchain-core library test suites and repository fixtures that exercise the image path loader with traversal strings — suppressed by filter_test_fixtures.
  • Documentation, notebooks or scaffolding snippets that use placeholder path tokens rather than concrete filesystem targets — suppressed by filter_placeholders.
  • Container/CI tooling prompts that legitimately reference /run/secrets/* while the same payload independently mentions ChatPromptTemplate.from_messages.

References