CVE-2025-65106

Affected versions of the langchain-core package are vulnerable to Template Injection due to improper neutralization of attribute access and indexing expressions in prompt templates constructed from untrusted input. The ChatPromptTemplate class and related prompt template implementations for f-string, Mustache, and Jinja2 formats allow attacker-controlled template strings such as {msg.class.name} or {{question.parse_raw}} to traverse Python object attributes and dictionary-style lookups, exposing internal properties like class metadata or globals when complex objects such as HumanMessage or other message objects are passed into the template context.