CVE-2026-40087: LangChain incomplete f-string validation in prompt templates

# CVE-2026-40087: LangChain incomplete f-string validation in prompt templates

https://gcdradar.vercel.app/incidents/cve-2026-40087-langchain-incomplete-f-string-validation-in-p · AIR-2026-0562 · closed 2026-04-08

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-04-08
- AI role: Attack on AI
- Products: LangChain
- CVE ids: CVE-2026-40087
- CVSS: 5.3

## Summary

LangChain exhibited incomplete prompt template validation where certain classes permitted attribute access or indexing expressions during formatting. This could allow unintended data evaluation within prompt templates.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-04-09: CVE-2026-40087: LangChain is a framework for building agents and LLM-powered applications. (https://nvd.nist.gov/vuln/detail/CVE-2026-40087)
- 2026-04-08: CVE-2026-40087: LangChain has incomplete f-string validation in prompt templates (https://github.com/advisories/GHSA-926x-3r5x-gfhw)

## Sources

- 2026-04-08 GitHub Advisory Database: CVE-2026-40087: LangChain has incomplete f-string validation in prompt templates https://github.com/advisories/GHSA-926x-3r5x-gfhw
- 2026-04-09 NVD: CVE-2026-40087: LangChain is a framework for building agents and LLM-powered applications. https://nvd.nist.gov/vuln/detail/CVE-2026-40087

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.