Description (CNA)
langchain-ai v0.3.51 was discovered to contain an indirect prompt injection vulnerability in the GmailToolkit component. This vulnerability allows attackers to execute arbitrary code and compromise the application via a crafted email message. NOTE: this is disputed by the Supplier because the code-execution issue was introduced by user-written code that does not adhere to the LangChain security practices.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://github.com/langchain-ai/langchain/issues/30833
- https://github.com/Jr61-star/CVEs/blob/main/CVE-2025-46059.md
- https://github.com/langchain-ai/langchain-community/issues/217#issuecomment-3144824471
- https://python.langchain.com/docs/security/
ADP enrichment
No English description supplied.
No references supplied.