CVE-2026-34070
Published: 31 March 2026
Summary
CVE-2026-34070 is a high-severity Path Traversal (CWE-22) vulnerability in Langchain Langchain Core. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as NLP and Transformers; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-34070 is a path traversal vulnerability (CWE-22) affecting the LangChain framework, an open-source tool for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in the langchain_core.prompts.loading module read files from paths embedded in deserialized configuration dictionaries without validation for directory traversal or absolute path injection. This flaw arises when applications invoke load_prompt() or load_prompt_from_config() with user-influenced prompt configurations, enabling unauthorized file access on the host filesystem, limited only by file extension checks (.txt for templates, .json/.yaml for examples). The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
A remote, unauthenticated attacker can exploit this issue by supplying a maliciously crafted prompt configuration dictionary to a vulnerable LangChain application. If the application deserializes and passes this input to the affected loading functions, the attacker can traverse directories or inject absolute paths to read sensitive files accessible to the host process. Exploitation requires no privileges or user interaction, making it suitable for automated attacks over the network, though success depends on the application's handling of external prompt data.
The issue was addressed in LangChain version 1.2.22, as detailed in the project's security advisory (GHSA-qh6h-p6c9-ff54), release notes, and the patching commit (27add913474e01e33bededf4096151130ba0d47c). Security practitioners should upgrade to 1.2.22 or later and audit applications for safe handling of user-supplied prompt configurations to prevent deserialization of untrusted inputs.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17283
Vulnerability details
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes…
more
user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
- CWE(s)
AI Security AnalysisAI
- AI Category
- NLP and Transformers
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: langchain, llm
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in LangChain prompt loading functions allows remote unauthenticated file reads on the host (T1005 Data from Local System, T1083 File and Directory Discovery) when user-supplied configs are processed; this is a classic remote exploit of a public-facing application (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied prompt configurations to block directory traversal and absolute path injection in LangChain's load_prompt functions.
Mandates timely patching of the known path traversal flaw in LangChain, as fixed in version 1.2.22.
Limits damage from successful path traversal by enforcing least privilege on the host process, restricting access to sensitive files.