Introduction
Attackers can compromise AI-powered email automation by sending crafted emails that exploit a critical prompt injection flaw in LangChain's GmailToolkit. The flaw allows arbitrary code execution in any environment running the affected component, which is a significant risk for organizations that use automated email workflows.
LangChain is an open-source framework for building applications on large language models (LLMs). Its GmailToolkit component lets developers automate Gmail interactions inside AI workflows. LangChain is widely adopted in the AI and automation community, so a vulnerability in one of its components can affect the security of a broad range of LLM-driven systems.
Technical information
CVE-2025-46059 is an indirect prompt injection vulnerability in LangChain's GmailToolkit component, affecting version 0.3.51. It occurs when the toolkit processes email content that contains hidden or obfuscated instructions, which the underlying language model then interprets as executable commands. An attacker can craft an email with HTML elements or encoded content that gets past basic sanitization. When GmailToolkit ingests that email, the embedded instructions can run as code, giving the attacker arbitrary code execution in the application environment. The flaw is tracked under CWE-94 (Improper Control of Generated Code).
According to public sources, the root cause is insufficient sanitization of email content before the toolkit passes it to the LLM. No public code snippets or exploit details are currently available.
Affected systems and versions
- Product: LangChain GmailToolkit
- Affected version: 0.3.51
- Other versions: public sources show no evidence that other versions are affected
- Vulnerable configuration: any deployment using GmailToolkit from LangChain v0.3.51 that processes untrusted email content
Vendor security history
LangChain has had similar vulnerabilities before, including CVE-2023-44467 and CVE-2023-46229, both involving prompt injection and code execution. The vendor has a record of responding quickly to security reports, but the recurrence of these issues suggests it still has trouble integrating LLMs securely with external data sources.
