PyPI: langchain-core
CVE-2026-34070
Safety vulnerability ID: SFTY-20260327-53300
Safety legacy ID: pyup.io-90748
Affected versions of the langchain-core package are vulnerable to Path Traversal due to improper validation of file paths embedded in deserialized prompt configuration dictionaries. The load_prompt() and load_prompt_from_config() functions in langchain_core.prompts.loading, through _load_template(), _load_examples(), and _load_few_shot_prompt(), read attacker-influenced values such as template_path, suffix_path, prefix_path, examples, and example_prompt_path without blocking absolute paths or .. traversal sequences before accessing .txt, .json, or .yaml files on disk.
Overview
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
Advisory
Affected versions of the langchain-core package are vulnerable to Path Traversal due to improper validation of file paths embedded in deserialized prompt configuration dictionaries. The load_prompt() and load_prompt_from_config() functions in langchain_core.prompts.loading, through _load_template(), _load_examples(), and _load_few_shot_prompt(), read attacker-influenced values such as template_path, suffix_path, prefix_path, examples, and example_prompt_path without blocking absolute paths or .. traversal sequences before accessing .txt, .json, or .yaml files on disk.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260327-53300/CVE-2026-34070
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34070
- https://github.com/advisories/GHSA-qh6h-p6c9-ff54
- https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
- https://pypi.org/project/langchain-core
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54
- https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22
- https://nvd.nist.gov/vuln/detail/CVE-2026-34070
- https://github.com/advisories/GHSA-qh6h-p6c9-ff54
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more