langchaingo: jinja2 prompt templates allow server-side template injection and file read

CVSS 9.8CVE-2025-9556AI/ML frameworks & servingcurated

Impact

langchaingo parses prompts with jinja2 syntax through gonja 1.5.3, and gonja honours the include and extends tags. Anything that reaches the prompt template - user input, a retrieved document, a tool result - can therefore read files off the host, with /etc/passwd given as the demonstrated example. On a GPU fleet the process doing the reading is typically an agent or RAG service running next to the model with mounted secrets, service-account tokens and dataset paths, so a file-read primitive in that process is credential disclosure rather than a curiosity. The advisory rates it as full compromise; the described mechanism is file inclusion in the template engine.

Who can reach it

Anyone who can influence text that ends up in a langchaingo prompt template. For an exposed chat or agent endpoint that means an unauthenticated remote user; internally it includes any tenant whose documents or tool output are templated.

What to do

Update langchaingo to a release containing PR #1348 and rebuild and redeploy the services that embed it - this is a Go library, so there is no package to patch in place on the node. Until then, stop passing untrusted content through jinja2-formatted prompts and prefer the non-jinja template path. Review the service account and mounted secrets of any affected agent for exposure.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-9556 https://github.com/tmc/langchaingo/security/advisories/GHSA-mgcj-g55g-rf6h https://github.com/tmc/langchaingo/pull/1348 https://www.kb.cert.org/vuls/id/949137

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.