CWE-1336
AllowedImproper Neutralization of Special Elements Used in a Template Engine
Abstraction: Base · Status: Incomplete
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
314 vulnerabilities reference this CWE, most recent first.
GHSA-858Q-77WX-HHX6
Vulnerability from github – Published: 2025-12-02 01:24 – Updated: 2025-12-02 01:24Summary
A user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.
Details
Grav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true). A user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.
This enables exploitation of Grav internal APIs such as:
- grav.user.update() and grav.user.save() for escalating the current user to super admin or admin
- grav.scheduler.addCommand(), grav.scheduler.save() and grav.scheduler.run() for code execution
The Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the system/src/Grav/Common directory.
PoC
Preconditions:
- You must have access to a non-admin user with permission to create/edit pages (
admin.pagesaccess) - For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.
Steps to reproduce Privilege Escalation:
- Login into the non-admin page (default at
cms-url/login). - Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
- Inject the following payload into the page content to escalate privileges:
{% set _ = grav.user.update({
'access': {
'admin': {
'login': true,
'super': true
}
}
}, {}) %}
{% set _ = grav.user.save() %}
- Visit the edited/created page url. The logged in user is now admin. (Note: For the changes to show, you need to log out of the admin panel and relogin).
Steps to reproduce Remote Code Execution:
- Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -> Process: Twig: true).
- Inject the following payload into the page content to execute commands:
{% set _ = grav.scheduler.addCommand('curl', ['http://localhost:8000']) %}
{% set _ = grav.scheduler.save() %}
{% set _ = grav.scheduler.run() %}
- Visit the page to trigger the execution. The system will issue a
curlrequest.
Impact
This vulnerability allows: - Privilege Escalation from any user with page editing capabilities to full admin (super) access. - Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.
It affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "getgrav/grav"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.0-beta.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66297"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-02T01:24:19Z",
"nvd_published_at": "2025-12-01T21:15:53Z",
"severity": "HIGH"
},
"details": "### Summary\nA user with admin panel access and permissions to create or edit pages in Grav CMS can enable Twig processing in the page frontmatter. By injecting malicious Twig expressions, the user can escalate their privileges to admin or execute arbitrary system commands via the scheduler API. This results in both Privilege Escalation (PE) and Remote Code Execution (RCE) vulnerabilities.\n\n### Details\nGrav CMS allows Twig to be executed in page templates if enabled in admin panel (process: twig: true).\nA user with publisher/editor privileges, that can create or edit pages and enable twig processing, can thereby inject arbitrary code that will execute in the context of the page render.\n\nThis enables exploitation of Grav internal APIs such as:\n- `grav.user.update()` and `grav.user.save()` for escalating the current user to super admin or admin\n- `grav.scheduler.addCommand()`, `grav.scheduler.save()` and `grav.scheduler.run()` for code execution\n\nThe Twig sandbox is not enforced in this context, allowing full access to any backend PHP object and method in the `system/src/Grav/Common` directory.\n\n### PoC\n#### Preconditions:\n- You must have access to a **non-admin** user with permission to create/edit pages (```admin.pages``` access)\n- For Privilege Escalation, you also have to be logged in to the site with the same user as the admin panel.\n\n#### Steps to reproduce Privilege Escalation:\n1. Login into the non-admin page (default at `cms-url/login`).\n2. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -\u003e Process: Twig: true).\n3. Inject the following payload into the page content to escalate privileges:\n```\n{% set _ = grav.user.update({\n \u0027access\u0027: {\n \u0027admin\u0027: {\n \u0027login\u0027: true,\n \u0027super\u0027: true\n }\n }\n}, {}) %}\n{% set _ = grav.user.save() %}\n```\n4. Visit the edited/created page url. The logged in user is now admin. (*Note: For the changes to show, you need to log out of the admin panel and relogin).*\n\n#### Steps to reproduce Remote Code Execution:\n1. Login to the admin panel, create or edit a page and set the Twig processing to true (Advanced -\u003e Process: Twig: true).\n2. Inject the following payload into the page content to execute commands:\n```\n{% set _ = grav.scheduler.addCommand(\u0027curl\u0027, [\u0027http://localhost:8000\u0027]) %}\n{% set _ = grav.scheduler.save() %}\n{% set _ = grav.scheduler.run() %}\n```\n3. Visit the page to trigger the execution. The system will issue a `curl` request.\n\n### Impact\nThis vulnerability allows:\n- Privilege Escalation from any user with page editing capabilities to full admin (super) access.\n- Remote Code Execution, as the attacker can run system arbitrary commands via the scheduler API.\n\nIt affects any Grav CMS installation where users with lower privileges are allowed to create or edit pages and Twig processing is not globally disabled.",
"id": "GHSA-858q-77wx-hhx6",
"modified": "2025-12-02T01:24:19Z",
"published": "2025-12-02T01:24:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-858q-77wx-hhx6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66297"
},
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/commit/e37259527d9c1deb6200f8967197a9fa587c6458"
},
{
"type": "PACKAGE",
"url": "https://github.com/getgrav/grav"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection"
}
GHSA-85QC-PP3M-XM3F
Vulnerability from github – Published: 2025-02-10 18:30 – Updated: 2025-02-26 21:30OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.
{
"affected": [],
"aliases": [
"CVE-2024-54954"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-10T18:15:29Z",
"severity": "HIGH"
},
"details": "OneBlog v2.3.6 was discovered to contain a template injection vulnerability via the template management department.",
"id": "GHSA-85qc-pp3m-xm3f",
"modified": "2025-02-26T21:30:32Z",
"published": "2025-02-10T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54954"
},
{
"type": "WEB",
"url": "https://gist.github.com/kaoniniang2/03658cc78e789b992b378f4951bedfb7"
},
{
"type": "WEB",
"url": "https://gitee.com/yadong.zhang/DBlog/issues/IB6552"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8G7P-MX5X-8FRC
Vulnerability from github – Published: 2024-04-09 15:30 – Updated: 2024-04-09 15:30A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.
{
"affected": [],
"aliases": [
"CVE-2023-47542"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-09T15:15:28Z",
"severity": "MODERATE"
},
"details": "A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates.",
"id": "GHSA-8g7p-mx5x-8frc",
"modified": "2024-04-09T15:30:37Z",
"published": "2024-04-09T15:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47542"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-23-419"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8G9W-79W6-CW84
Vulnerability from github – Published: 2026-01-29 21:30 – Updated: 2026-01-30 00:31A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into env.from_string, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.
{
"affected": [],
"aliases": [
"CVE-2025-69516"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-29T20:16:09Z",
"severity": "HIGH"
},
"details": "A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privileged users with Report Viewer or Report Manager permissions to achieve remote command execution on the server. This occurs due to improper sanitization of the template_md parameter, enabling direct injection of Jinja2 templates. This occurs due to misuse of the generate_html() function, the user-controlled value is inserted into `env.from_string`, a function that processes Jinja2 templates arbitrarily, making an SSTI possible.",
"id": "GHSA-8g9w-79w6-cw84",
"modified": "2026-01-30T00:31:22Z",
"published": "2026-01-29T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69516"
},
{
"type": "WEB",
"url": "https://gist.github.com/NtGabrielGomes/7c424367cc316fd7527f668ff076fece"
},
{
"type": "WEB",
"url": "https://github.com/amidaware/tacticalrmm"
},
{
"type": "WEB",
"url": "https://www.amidaware.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QPG-H99J-C4J3
Vulnerability from github – Published: 2024-04-03 03:30 – Updated: 2024-08-16 18:30Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.
{
"affected": [],
"aliases": [
"CVE-2024-24724"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-03T03:15:09Z",
"severity": "CRITICAL"
},
"details": "Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.",
"id": "GHSA-8qpg-h99j-c4j3",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-04-03T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24724"
},
{
"type": "WEB",
"url": "https://gibbonedu.org/download"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/177857"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8R2X-8F22-8FW5
Vulnerability from github – Published: 2025-08-20 09:30 – Updated: 2026-04-01 18:35Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection. This issue affects JetEngine: from n/a through 3.7.0.
{
"affected": [],
"aliases": [
"CVE-2025-53194"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-82"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-20T08:15:39Z",
"severity": "HIGH"
},
"details": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Crocoblock JetEngine allows Code Injection. This issue affects JetEngine: from n/a through 3.7.0.",
"id": "GHSA-8r2x-8f22-8fw5",
"modified": "2026-04-01T18:35:54Z",
"published": "2025-08-20T09:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53194"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/jet-engine/vulnerability/wordpress-jetengine-3-7-0-remote-code-execution-rce-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8V9W-WQXW-HP8G
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 18:31Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.
Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.
{
"affected": [],
"aliases": [
"CVE-2025-12107"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T10:16:09Z",
"severity": "CRITICAL"
},
"details": "Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates. \n\n Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.",
"id": "GHSA-8v9w-wqxw-hp8g",
"modified": "2026-02-19T18:31:54Z",
"published": "2026-02-19T18:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12107"
},
{
"type": "WEB",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4517"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8WG7-WM29-2RVG
Vulnerability from github – Published: 2026-03-16 18:11 – Updated: 2026-03-16 21:57The Webhooks plugin renders user-supplied template content through Twig’s renderString() function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.
This is possible even if allowAdminChanges is set to false.
Affected users should update to version 3.2.0 to mitigate the issue.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "craftcms/webhooks"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32261"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-16T18:11:23Z",
"nvd_published_at": "2026-03-16T19:16:17Z",
"severity": "HIGH"
},
"details": "The Webhooks plugin renders user-supplied template content through Twig\u2019s `renderString()` function without sandbox protection. This allows an authenticated user with access to the Craft control panel and permissions to access the Webhooks plugin to inject Twig template code that calls arbitrary PHP functions.\n\nThis is possible even if `allowAdminChanges` is set to `false`.\n\nAffected users should update to version 3.2.0 to mitigate the issue.",
"id": "GHSA-8wg7-wm29-2rvg",
"modified": "2026-03-16T21:57:13Z",
"published": "2026-03-16T18:11:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/webhooks/security/advisories/GHSA-8wg7-wm29-2rvg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32261"
},
{
"type": "WEB",
"url": "https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62"
},
{
"type": "PACKAGE",
"url": "https://github.com/craftcms/webhooks"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin"
}
GHSA-8WQ7-HHJJ-FPQV
Vulnerability from github – Published: 2022-01-22 00:00 – Updated: 2023-07-11 00:21A remote code execution (RCE) vulnerability in the Template Management function of MCMS allows attackers to execute arbitrary code via a crafted payload.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "net.mingsoft:ms-mcms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-22930"
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-11T00:21:57Z",
"nvd_published_at": "2022-01-21T00:15:00Z",
"severity": "CRITICAL"
},
"details": "A remote code execution (RCE) vulnerability in the Template Management function of MCMS allows attackers to execute arbitrary code via a crafted payload.",
"id": "GHSA-8wq7-hhjj-fpqv",
"modified": "2023-07-11T00:21:57Z",
"published": "2022-01-22T00:00:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22930"
},
{
"type": "WEB",
"url": "https://github.com/ming-soft/MCMS/issues/98"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20220201022121/https://gitee.com/mingSoft/MCMS/issues/I4Q4M6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "RCE in Mingsoft MCMS"
}
GHSA-926X-3R5X-GFHW
Vulnerability from github – Published: 2026-04-08 21:51 – Updated: 2026-04-10 14:41LangChain's f-string prompt-template validation was incomplete in two respects.
First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate those expressions during formatting.
Examples of the affected shape include:
"{message.additional_kwargs[secret]}"
"https://example.com/{image.__class__.__name__}.png"
Second, f-string validation based on parsed top-level field names did not reject nested replacement fields inside format specifiers. For example:
"{name:{name.__class__.__name__}}"
In this pattern, the nested replacement field appears in the format specifier rather than in the top-level field name. As a result, earlier validation based on parsed field names did not reject the template even though Python formatting would still attempt to resolve the nested expression at runtime.
Affected usage
This issue is only relevant for applications that accept untrusted template strings, rather than only untrusted template variable values.
In addition, practical impact depends on what objects are passed into template formatting:
- If applications only format simple values such as strings and numbers, impact is limited and may only result in formatting errors.
- If applications format richer Python objects, attribute access and indexing may interact with internal object state during formatting.
In many deployments, these conditions are not commonly present together. Applications that allow end users to author arbitrary templates often expose only a narrow set of simple template variables, while applications that work with richer internal Python objects often keep template structure under developer control. As a result, the highest-impact scenario is plausible but is not representative of all LangChain applications.
Applications that use hardcoded templates or that only allow users to provide variable values are not affected by this issue.
Impact
The direct issue in DictPromptTemplate and ImagePromptTemplate allowed attribute access and indexing expressions to survive template construction and then be evaluated during formatting. When richer Python objects were passed into formatting, this could expose internal fields or nested data to prompt output, model context, or logs.
The nested format-spec issue is narrower in scope. It bypassed the intended validation rules for f-string templates, but in simple cases it results in an invalid format specifier error rather than direct disclosure. Accordingly, its practical impact is lower than that of direct top-level attribute traversal.
Overall, the practical severity depends on deployment. Meaningful confidentiality impact requires attacker control over the template structure itself, and higher impact further depends on the surrounding application passing richer internal Python objects into formatting.
Fix
The fix consists of two changes.
First, LangChain now applies f-string safety validation consistently to DictPromptTemplate and ImagePromptTemplate, so templates containing attribute access or indexing expressions are rejected during construction and deserialization.
Second, LangChain now rejects nested replacement fields inside f-string format specifiers.
Concretely, LangChain validates parsed f-string fields and raises an error for:
- variable names containing attribute access or indexing syntax such as
.or[] - format specifiers containing
{or}
This blocks templates such as:
"{message.additional_kwargs[secret]}"
"https://example.com/{image.__class__.__name__}.png"
"{name:{name.__class__.__name__}}"
The fix preserves ordinary f-string formatting features such as standard format specifiers and conversions, including examples like:
"{value:.2f}"
"{value:>10}"
"{value!r}"
In addition, the explicit template-validation path now applies the same structural f-string checks before performing placeholder validation, ensuring that the security checks and validation checks remain aligned.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 0.3.83"
},
"package": {
"ecosystem": "PyPI",
"name": "langchain-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.84"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "langchain-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0a1"
},
{
"fixed": "1.2.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-40087"
],
"database_specific": {
"cwe_ids": [
"CWE-1336",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-08T21:51:32Z",
"nvd_published_at": "2026-04-09T20:16:27Z",
"severity": "MODERATE"
},
"details": "LangChain\u0027s f-string prompt-template validation was incomplete in two respects.\n\nFirst, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as `PromptTemplate`. In particular, `DictPromptTemplate` and `ImagePromptTemplate` could accept templates containing attribute access or indexing expressions and subsequently evaluate those expressions during formatting.\n\nExamples of the affected shape include:\n\n```python\n\"{message.additional_kwargs[secret]}\"\n\"https://example.com/{image.__class__.__name__}.png\"\n```\n\nSecond, f-string validation based on parsed top-level field names did not reject nested replacement fields inside format specifiers. For example:\n\n```python\n\"{name:{name.__class__.__name__}}\"\n```\n\nIn this pattern, the nested replacement field appears in the format specifier rather than in the top-level field name. As a result, earlier validation based on parsed field names did not reject the template even though Python formatting would still attempt to resolve the nested expression at runtime.\n\n## Affected usage\n\nThis issue is only relevant for applications that accept untrusted template strings, rather than only untrusted template variable values.\n\nIn addition, practical impact depends on what objects are passed into template formatting:\n\n- If applications only format simple values such as strings and numbers, impact is limited and may only result in formatting errors.\n- If applications format richer Python objects, attribute access and indexing may interact with internal object state during formatting.\n\nIn many deployments, these conditions are not commonly present together. Applications that allow end users to author arbitrary templates often expose only a narrow set of simple template variables, while applications that work with richer internal Python objects often keep template structure under developer control. As a result, the highest-impact scenario is plausible but is not representative of all LangChain applications.\n\nApplications that use hardcoded templates or that only allow users to provide variable values are not affected by this issue.\n\n## Impact\n\nThe direct issue in `DictPromptTemplate` and `ImagePromptTemplate` allowed attribute access and indexing expressions to survive template construction and then be evaluated during formatting. When richer Python objects were passed into formatting, this could expose internal fields or nested data to prompt output, model context, or logs.\n\nThe nested format-spec issue is narrower in scope. It bypassed the intended validation rules for f-string templates, but in simple cases it results in an invalid format specifier error rather than direct disclosure. Accordingly, its practical impact is lower than that of direct top-level attribute traversal.\n\nOverall, the practical severity depends on deployment. Meaningful confidentiality impact requires attacker control over the template structure itself, and higher impact further depends on the surrounding application passing richer internal Python objects into formatting.\n\n## Fix\n\nThe fix consists of two changes.\n\nFirst, LangChain now applies f-string safety validation consistently to `DictPromptTemplate` and `ImagePromptTemplate`, so templates containing attribute access or indexing expressions are rejected during construction and deserialization.\n\nSecond, LangChain now rejects nested replacement fields inside f-string format specifiers.\n\nConcretely, LangChain validates parsed f-string fields and raises an error for:\n\n- variable names containing attribute access or indexing syntax such as `.` or `[]`\n- format specifiers containing `{` or `}`\n\nThis blocks templates such as:\n\n```python\n\"{message.additional_kwargs[secret]}\"\n\"https://example.com/{image.__class__.__name__}.png\"\n\"{name:{name.__class__.__name__}}\"\n```\n\nThe fix preserves ordinary f-string formatting features such as standard format specifiers and conversions, including examples like:\n\n```python\n\"{value:.2f}\"\n\"{value:\u003e10}\"\n\"{value!r}\"\n```\n\nIn addition, the explicit template-validation path now applies the same structural f-string checks before performing placeholder validation, ensuring that the security checks and validation checks remain aligned.",
"id": "GHSA-926x-3r5x-gfhw",
"modified": "2026-04-10T14:41:45Z",
"published": "2026-04-08T21:51:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-926x-3r5x-gfhw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40087"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/pull/36612"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/pull/36613"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/commit/6bab0ba3c12328008ddca3e0d54ff5a6151cd27b"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/commit/af2ed47c6f008cdd551f3c0d87db3774c8dfe258"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langchain"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D0.3.84"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.28"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "LangChain has incomplete f-string validation in prompt templates"
}
Mitigation
Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
Mitigation
Use the template engine's sandbox or restricted mode, if available.
No CAPEC attack patterns related to this CWE.