Langchaingo Server-Side Template Injection Vulnerability Allowing Unauthorized File Access

A server-side template injection vulnerability has been identified in Langchaingo, specifically in versions that support Jinja2 syntax. This vulnerability arises from the use of the Gonja library, which allows templates to include and extend other files. An attacker can exploit this by injecting a statement into a prompt that reads the '/etc/passwd' file, leading to unauthorized access to sensitive file information.

Impact

Exploitation of this vulnerability allows for server-side template injection, where an attacker can manipulate template rendering to execute arbitrary code or access restricted files on the server.

Remediation

Langchaingo has introduced a patch that changes the prompt package to use a more secure default rendering context for Jinja2-compatible syntax. Users should update to the latest version of Langchaingo to apply this security enhancement.