LangChain Prompt Injection: Attack Surface, Real CVEs, and How RedLens Tests It

In LangChain, prompt injection is not a single bug to patch. It is an architectural attack surface: the same feature set that makes LangChain powerful — chains that pass model output into the next step, agents that pick tools, retrievers that pull in outside documents, and parsers that deserialize model output back into objects — is the surface an attacker writes to.

Why LangChain is a broad target, specifically

A plain chatbot exposes one injection path: the user's message. A LangChain application exposes several, because untrusted text enters at more than one point and the framework then acts on it:

• Chains feed one component's output into the next. A payload that survives the first step is carried forward as trusted context.
• Agents choose which tool to call from the model's own reasoning. Text that influences that reasoning influences which real function runs, and with what arguments.
• Retrievers / RAG pull documents from vector stores, the web, or files. Whoever can write to those sources can write to the prompt — this is indirect prompt injection, and the agent has no user watching each step.
• Output parsers and deserialization turn model output back into Python objects. If the model can be steered to emit a crafted structure, the parser can be steered too.

This is documented, not theoretical

LangChain's own CVE history shows the same pattern repeatedly: a prompt-injection foothold escalates into code execution, data access, or secret theft because the framework treats model output as trusted input to a real operation.

CVE	Where	Prompt injection leads to
CVE-2023-29374	LLMMathChain / PALChain (≤ 0.0.131)	Arbitrary Python execution via exec on model-generated "math" (CVSS 9.8).
CVE-2023-46229	Sitemap loader (< 0.0.317)	Server-side request forgery via crafted sitemaps, reaching internal services.
CVE-2024-8309	GraphCypherQAChain	Injected text shapes the generated Cypher query → database compromise.
CVE-2025-68664	langchain-core ("LangGrinch")	A malicious lc key in metadata/additional_kwargs/response_metadata is deserialized into a trusted object → RCE and exfiltration of env-var secrets: cloud creds, DB/RAG connection strings, LLM API keys (CVSS 9.3).

The lesson across all four: the dangerous step is never the model "saying" something bad — it is the framework doing something with what the model said.

How RedLens red-teams a LangChain application

RedLens does not scan a model in the abstract; it exercises the injection paths above against your deployed application, using the methodologies in its catalogue that map to LangChain's surface. The attacker payloads are generated on RedLens's own self-hosted attacker models and judged for whether the target actually complied — a deflected attempt and a successful one are scored differently, not lumped together.

RedLens methodology	What it exercises in a LangChain app
Indirect Prompt Injection (IPI)	Payloads embedded in retrieved documents / tool outputs the agent ingests — the RAG and tool-result path, where no user is watching.
Tool Chain Hijacking (TCH)	Steering the agent's tool selection and arguments toward unintended or sensitive functions.
Retrieval-Augmented Poisoning (RAP)	Adversarial content planted in the vector store / knowledge base ahead of retrieval.
Instruction Override (IOA)	Direct overrides of the chain's system prompt through user-controlled input.
System Prompt Extraction (SPE)	Eliciting the chain's hidden instructions and any business logic embedded in them.
Autonomous Action Amplification (AAA)	Exploiting agent self-prompting / recursion to escalate what a single request can do.

The full methodology, the fixed attacker/judge setup, and the scoring are published on the methodology page — RedLens reports what its scans actually find, and does not publish invented numbers.

Reducing the surface

• Treat every non-user input as untrusted — retrieved documents, tool outputs, and file contents are attacker-writable, not context.
• Constrain tools, not just prompts. Allowlist tool calls and require explicit authorization for sensitive ones; a prompt guard alone does not stop TCH.
• Never exec / deserialize model output into a privileged operation. The LangChain CVEs are all this mistake in different clothes. Keep secrets out of any object the model can influence.
• Pin and patch langchain / langchain-core — several of the above are fixed only in later versions.
• Test the deployed application, not the model alone. The vulnerabilities live in the wiring between components, which only a scan against the running app can exercise.

Sources for the CVEs referenced: the GitHub Advisory Database, NVD, and vendor disclosures. This page is maintained by RedLens AI Security Research; the RedLens methodology is documented and its published findings come from real scan output.