| Component | LangChain |
| Severity | high (CVSS 7.5) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Published (NVD) | 2026-03-31 |
| Last modified | 2026-08-25 |
| Affected versions | langchain_core < 1.2.22 |
| Fixed in | 1.2.22 |
| Weakness | CWE-22 |
| CISA KEV | not listed |
NVD description
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
What to do
- Upgrade LangChain to
1.2.22or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-34070
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54
- https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22
- https://access.redhat.com/errata/RHSA-2026:24766
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:59159
- https://access.redhat.com/security/cve/CVE-2026-34070
- https://bugzilla.redhat.com/show_bug.cgi?id=2453287
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34070.json
Other LangChain CVEs
LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values...
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented st...
The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write fi...
The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By craf...
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker ca...
LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and la...