LangChainGo Vulnerability Allows Malicious Prompt Injection to Access Sensitive Data

**CVE-2025-9556 — LangChainGo arbitrary file read via Gonja template engine:** A server-side template injection vulnerability in LangChainGo's use of the Gonja (Jinja2-compatible) template engine allows an attacker who can supply prompt templates to read arbitrary files on the host (potentially exposing configuration files, private keys, and credentials). The LangChainGo maintainer released an update introducing RenderTemplateFS to isolate template rendering from filesystem access; users should upgrade to the latest release (go get github.com/tmc/langchaingo@latest) and review template usage to ensure RenderTemplateFS is used.