CVE-2025-9556 — CRITICAL (CVSS 9.8) AI Security Vulnerability

CISO Take

Any Go-based AI application using langchaingo with Jinja2 prompt templates is remotely exploitable with zero credentials required—CVSS 9.8 is accurate. Update langchaingo immediately via the fix in PR #1348; if patching today is not possible, disable template parsing and block Jinja2 control characters ({% %}) at the application boundary. Audit all internal and customer-facing deployments: /etc/passwd is the proof-of-concept target, but environment variable exfiltration of API keys and database credentials is the realistic attacker objective.

Risk Assessment

Critical. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means any network-reachable langchaingo instance is exploitable by an unauthenticated attacker with no specialized skill. The C:H/I:H/A:H triad suggests the attack surface extends beyond simple file read—gonja template directives may enable server-side code execution depending on engine feature exposure. Public-facing AI products and internal developer tooling built on langchaingo carry equivalent risk. Expect automated scanning within days of disclosure given the trivial exploit pattern.

Severity & Risk

CVSS 3.1

9.8 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

Recommended Action

5 steps

Patch: Apply the fix from GitHub PR #1348 or update to the patched langchaingo release as the immediate priority.
Workaround: If patching is not immediately feasible, disable Jinja2 template parsing entirely and serve static prompt templates only.
Input validation: Enforce strict allowlisting at the application boundary—reject any prompt input containing Jinja2 control syntax ({% %}, {{ }}, {# #}) before it reaches the template engine.
Detection: Enable host-level file auditing (auditd or equivalent) and alert on access to /etc/passwd, /etc/shadow, .env files, and credential stores from the application process. Review application logs for unexpected file paths in responses.
Scope audit: Enumerate all services importing langchaingo and confirm which pass user-controlled content to template constructors—prioritize public-facing services.

CISA SSVC Assessment

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Code Execution Data Extraction Framework Agent AML.T0010.001 - AI Software AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0051 - LLM Prompt Injection AML.T0057 - LLM Data Leakage

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - AI Risk Assessment A.9.3 - AI System Security Testing

NIST AI RMF

GOVERN 1.7 - Processes for AI Risk Management MANAGE 2.2 - Mechanisms to Minimize AI Risks

OWASP LLM Top 10

LLM01 - Prompt Injection LLM05 - Supply Chain Vulnerabilities LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2025-9556?

Any Go-based AI application using langchaingo with Jinja2 prompt templates is remotely exploitable with zero credentials required—CVSS 9.8 is accurate. Update langchaingo immediately via the fix in PR #1348; if patching today is not possible, disable template parsing and block Jinja2 control characters ({% %}) at the application boundary. Audit all internal and customer-facing deployments: /etc/passwd is the proof-of-concept target, but environment variable exfiltration of API keys and database credentials is the realistic attacker objective.

Is CVE-2025-9556 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-9556, increasing the risk of exploitation.

How to fix CVE-2025-9556?

1. Patch: Apply the fix from GitHub PR #1348 or update to the patched langchaingo release as the immediate priority. 2. Workaround: If patching is not immediately feasible, disable Jinja2 template parsing entirely and serve static prompt templates only. 3. Input validation: Enforce strict allowlisting at the application boundary—reject any prompt input containing Jinja2 control syntax ({% %}, {{ }}, {# #}) before it reaches the template engine. 4. Detection: Enable host-level file auditing (auditd or equivalent) and alert on access to /etc/passwd, /etc/shadow, .env files, and credential stores from the application process. Review application logs for unexpected file paths in responses. 5. Scope audit: Enumerate all services importing langchaingo and confirm which pass user-controlled content to template constructors—prioritize public-facing services.

What systems are affected by CVE-2025-9556?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM application backends, RAG pipelines, chatbot infrastructure.

What is the CVSS score for CVE-2025-9556?

CVE-2025-9556 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.08%.

Technical Details

NVD Description

Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a statement into a prompt to read the "etc/passwd" file.

Exploitation Scenario

An adversary interacting with a public-facing AI chatbot or API built on langchaingo submits a prompt containing Jinja2 file-include directives, for example '{% include "/etc/passwd" %}' or '{% extends "/proc/self/environ" %}'. The gonja v1.5.3 template engine processes the input and reads the referenced file from the host filesystem. File contents are injected into the prompt passed to the LLM or returned directly in the API response. The attacker extracts username lists, then pivots to reading application configuration files and environment variables to recover database connection strings, Stripe API keys, or cloud provider credentials. With those credentials, the attacker achieves lateral movement into the AI backend infrastructure, downstream databases, or connected SaaS services.