The vulnerability allows an attacker to create prompt templates with input variables that can read any user-specified path from the server file system. If the outputs of these templates are exposed to the user, either directly or through a model, the attacker can read the contents of local files. This can lead to exposure of sensitive information stored on the server.

An attacker could exploit this vulnerability by creating a prompt template with an image URL variable pointing to a sensitive file on the server. When the template is invoked, the contents of the file are read and encoded in the output. If this output is exposed to the attacker, they can access the sensitive information.

Users of langchain-core versions >=0.1.17,<0.1.53 || >=0.2.0,<0.2.43 || >=0.3.0,<0.3.15 who allow user-specified prompt templates or inputs to prompt templates with image URL variables.