High severity · published Mar 31, 2026
CVE-2026-34070
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
langchain · langchain-ai
< 1.2.22 · source: vendor
LC
Langchain Core · Langchain
before 1.2.22 · source: NVD
OL
OpenShift Lightspeed · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Ansible Automation Platform 2.5 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat OpenShift AI 3.3 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34070
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34070
Patch
https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
Release Notes
https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22
Exploit
https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:24766
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:37275
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:59159
More from langchain
8.2
CVE-2026-44843
LangChain: Unsafe deserialization of attacker-controlled LangChain objects through overly broad `load()` allowlists
8.2
CVE-2025-68664
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
7.5
CVE-2024-58340
LangChain <= 0.3.1 MRKLOutputParser ReDoS
5.5
CVE-2026-55443
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.3
CVE-2026-40087
LangChain has incomplete f-string validation in prompt templates