External risk intelligence

Langchaingo Server Side Template Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-9556

Langchaingo is a library used to build applications that process user-provided prompts. Because these prompts are frequently processed by internet-facing web applications or API endpoints to handle external user input, the vulnerable template injection surface is commonly exposed to public network traffic in standard deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Langchaingo allows attackers to inject code into prompts, potentially enabling them to read sensitive system files. This issue arises from how the system processes user-provided prompts, which can be exposed to external users through web applications or APIs. The main concern is confirming relevance and exposure within your environment.

Code injection in prompt processing.
Could allow sensitive file access.
Verify if this impacts your systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted prompt to an application that uses the affected library. This prompt, when processed, allows the attacker to inject code that reads sensitive system files, such as the "etc/passwd" file.

No authentication required.
Injecting malicious code into prompts.
Arbitrary file reads from the server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject commands into prompts that are processed by Langchaingo, potentially enabling them to read sensitive system files such as "/etc/passwd" under supported conditions.

Server-side template injection in Langchaingo.
Attackers insert statements into prompts.
Unauthorized access to system files.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Langchaingo, specifically related to how it parses prompts with Jinja2 syntax via the Gonja library, allows for server-side template injection. This could enable an attacker to execute commands to read sensitive system files. The initial step is to locate all instances of Langchaingo within your environment, assess their network exposure and criticality, identify the accountable teams or owners, and then prioritize remediation based on risk.

Identify affected applications and owners.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Langchaingo and why is it used?

Langchaingo is a Go-language framework designed for building applications that leverage Large Language Models (LLMs). Developers use it to simplify interactions with AI models, such as managing prompt templates and chaining complex workflows. It is frequently employed in web applications and API services where user-provided input is processed dynamically to generate AI responses.

What does CVE-2025-9556 mean in plain English?

This is a Server Side Template Injection (SSTI) vulnerability. It occurs because the library uses the Gonja parser to process Jinja2-style syntax in prompts. If the application does not properly restrict this process, an attacker can inject malicious template code that the server executes, potentially allowing them to read arbitrary files from the system, such as sensitive configuration or password files.

How does an attacker trigger this vulnerability?

An attacker triggers this by submitting a specially crafted prompt containing template injection syntax to an application that processes that input using the vulnerable Langchaingo configuration. The vulnerability is specifically tied to the processing of prompt templates; simply using Langchaingo for non-template tasks or with hardcoded, trusted prompts that do not incorporate user-provided data does not trigger this path.

Why should I care about this CVE?

You should care if your applications process user input via Langchaingo. According to Halo Surface Signal, this library is often used in internet-facing web applications or API endpoints where the template injection surface is directly reachable by public network traffic. If your service takes external input and passes it through this template parser, it is at higher risk of unauthorized file access.

What should I do first to address this issue?

Start by conducting an inventory of your software components to identify all applications currently utilizing Langchaingo. Once you have a list, work with the relevant development or engineering teams to determine which of those applications accept untrusted user input into their prompt templates. Prioritize updating or isolating those specific high-risk, internet-facing systems while awaiting formal remediation guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.