CVE-2025-9556

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-9556

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9556.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-9556

Aliases

GHSA-mgcj-g55g-rf6h

Published

2025-09-12T13:45:14.684Z

Modified

2026-07-15T01:49:20.334441184Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

CVE-2025-9556

Details

Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a statement into a prompt to read the "etc/passwd" file.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9556.json",
    "cna_assigner": "certcc"
}

References

Affected packages

Git / github.com/tmc/langchaingo

Affected ranges

Type

GIT

Repo

https://github.com/tmc/langchaingo

Events

Introduced

509308ff01c13e662d5613d3aea793fabe18edd2

Last affected

509308ff01c13e662d5613d3aea793fabe18edd2

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.1.14"
        },
        {
            "last_affected": "0.1.14"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.1.14

v0.*

v0.1.14

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9556.json"