CVE-2026-34070: Path Traversal Vulnerability in langchain-core Package
Summary
CVE-2026-34070: LangChain Core has Path Traversal vulnerabilites in legacy load_prompt functions. Affects langchain-core versions < 1.2.22. Fixed in 1.2.22. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Langchain-core is a Python package designed for building applications that utilize language models. It provides functionalities for loading prompts and managing configurations. However, certain legacy functions within this package are vulnerable to path traversal attacks, allowing unauthorized file access on the host filesystem.
Vulnerability Detail
The vulnerability arises from multiple functions in langchain_core.prompts.loading that read files from paths embedded in deserialized configuration dictionaries without proper validation. This oversight allows attackers to exploit user-influenced prompt configurations passed to load_prompt() or load_prompt_from_config(), enabling them to read arbitrary files on the host system. The affected functions include _load_template(), _load_examples(), and _load_few_shot_prompt(). The lack of validation against absolute path injection or directory traversal sequences poses a significant risk, particularly in applications that accept prompt configurations from untrusted sources.
How To Fix
Latest published version: 1.7.0 as of 22 Oct 2026
pip install --upgrade "langchain-core==1.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.22
This is the first release that contains the fix.
pip install --upgrade "langchain-core==1.2.22"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not possible, you can mitigate the risk by avoiding the use of the legacy load_prompt() and load_prompt_from_config() functions. Instead, utilize the newer serialization APIs: dumpd, dumps, load, and loads from langchain_core.load, which do not perform filesystem reads and use an allowlist-based security model.
Conclusion
The langchain-core package has a significant path traversal vulnerability that can lead to unauthorized file access. It is crucial to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring of open-source vulnerabilities is essential for maintaining application security.
See every vulnerability recorded for langchain-core →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Attackers can potentially access .txt files for templates and .json/.yaml files for examples, including sensitive information like cloud credentials and internal system prompts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected functions include _load_template(), _load_examples(), and _load_few_shot_prompt() within the langchain_core.prompts.loading module.
If you cannot update the package, avoid using the legacy load_prompt() and load_prompt_from_config() functions and switch to the newer serialization APIs.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain-core.
