PyPI/langchain-core CVE-2025-65106: high 8.3, EPSS 0.52%
LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
Action: Upgrade langchain-core to 0.3.80 or later.
pip install langchain-core==0.3.80pip install langchain-core==1.0.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.3.80 | - |
| 1.0.0 | 1.0.7 | - |
Fixed versions
| 0.3.80 | 1.0.7 |
Sources
- osv: PYSEC-2026-1518
- nvd: CVE-2025-65106
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-6qv9-48xg-fc7f
- https://github.com/langchain-ai/langchain/commit/c4b6ba254e1a49ed91f2e268e6484011c540542a
- https://github.com/langchain-ai/langchain/commit/fa7789d6c21222b85211755d822ef698d3b34e00
- https://github.com/langchain-ai/langchain
- https://pypi.org/project/langchain-core
- https://github.com/advisories/GHSA-6qv9-48xg-fc7f
CVE-2025-65106 · published · modified · JSON