LangChain: template injection in prompt templates exposes Python object internals

Impact

Applications that let untrusted input supply the prompt template string itself - not just the variables filled into it - can use template syntax to walk into Python object internals of the serving process. That is a read path into whatever the process holds: API keys for model providers, object storage credentials, other tenants' prompt data in memory. On a fleet this matters where an agent platform accepts user-authored templates, a common pattern in self-service LLM tooling running next to inference workloads.

Who can reach it

Network, unauthenticated in the worst case (PR:N): any user of an application that passes a user-supplied template string into ChatPromptTemplate or a related prompt template class. Applications that only interpolate user data into a fixed template are not affected.

What to do

Upgrade langchain to 0.3.80 or 1.0.7 and restart the application or worker processes. No node reboot or GPU downtime. If an upgrade has to wait, stop accepting template strings from users - accept only template variables.

References

Related entries

• vLLM: --revision pin ignored for some FunAudioChat and Tarsier2 processor, tokenizer and config loadsCVE-2026-100653 · vLLM (revision pin not propagated to FunAudioChat and Tarsier2 Hugging Face artifact loads)High
• Dagster: Vulnerability in Dagster Core prior to 1.13.1CVE-2026-41490 · DagsterHigh
• Gitingest: prefix-only host validation lets crafted URLs leak GitHub tokens to attacker hostsCVE-2026-82289 · Gitingest (_validate_host git host allowlist)High
• TorchServe (gRPC 7070/7071): gRPC ports bound to all interfaces regardless of configCVE-2024-35199 · TorchServe (gRPC 7070/7071)High
• Ollama (GGUF parser): Malformed 4-byte GGUF file crashes the server (two HTTP requests)CVE-2024-39720 · Ollama (GGUF parser)High
• LangChain Core: unescaped 'lc' keys let user data be revived as LangChain objects on loadCVE-2025-68664 · LangChain Core dumps()/dumpd() serializationHigh