CVE-2026-34070 LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
Attackers can read arbitrary files on the host filesystem by exploiting path traversal in LangChain Core's legacy prompt loading functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34070?
CVE-2026-34070 is a high-severity path traversal vulnerability in langchain-ai langchain, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
Weakness: CWE-22
Which versions are affected by CVE-2026-34070?
3 open source packages ship an affected version, including langchain-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
langchain-core PyPI | All versions | 1.2.22 |
langchain-core PyPI | All versions | 1.2.22 |
langchain-core PyPI | All versions | 1.2.22 |
Products include Langchain Langchain Core.
How do I fix CVE-2026-34070?
Upgrade langchain-core to 1.2.22 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-34070 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34070 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in langchain-ai langchain
- CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
- CVE-2026-40087 LangChain has incomplete f-string validation in prompt templates
- CVE-2026-26013 LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
Sources
Also known as CLSA-2026-1776126826, ECHO-34c7-ca18-1a8c, GHSA-qh6h-p6c9-ff54, PYSEC-2026-2193, ROOT-APP-PYPI-CVE-2026-34070.