#VU125665 Improper input validation in LangChain
Published: April 9, 2026
Vulnerability identifier: #VU125665
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
LangChain
LangChain
Software vendor:
LangChain
LangChain
Description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper input validation in DictPromptTemplate and ImagePromptTemplate when processing untrusted f-string template strings during formatting. A remote attacker can supply a specially crafted template containing attribute access or indexing expressions to disclose sensitive information.
Only applications that accept untrusted template strings are affected, and practical impact depends on richer Python objects being passed into template formatting.
Remediation
Install security update from vendor's website.