PYSEC-2026-2193
Vulnerability from pysec - Published: 2026-03-31 03:15 - Updated: 2026-07-13 05:49
VLAI
Details
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
Severity
7.5 (High)
Impacted products
| Name | purl | langchain-core | pkg:pypi/langchain-core |
|---|
Aliases
{
"affected": [
{
"ecosystem_specific": {},
"package": {
"ecosystem": "PyPI",
"name": "langchain-core",
"purl": "pkg:pypi/langchain-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.22"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.0.10",
"0.0.11",
"0.0.12",
"0.0.13",
"0.0.13rc1",
"0.0.13rc2",
"0.0.2",
"0.0.3",
"0.0.4",
"0.0.5",
"0.0.6",
"0.0.7",
"0.0.8",
"0.0.9",
"0.1.0",
"0.1.1",
"0.1.10",
"0.1.11",
"0.1.12",
"0.1.12rc1",
"0.1.13",
"0.1.14",
"0.1.15",
"0.1.15rc1",
"0.1.15rc2",
"0.1.16",
"0.1.17",
"0.1.18",
"0.1.19",
"0.1.2",
"0.1.20",
"0.1.21",
"0.1.22",
"0.1.23",
"0.1.24",
"0.1.25",
"0.1.26",
"0.1.27",
"0.1.28",
"0.1.29",
"0.1.3",
"0.1.30",
"0.1.31",
"0.1.32",
"0.1.33",
"0.1.33rc1",
"0.1.34",
"0.1.35",
"0.1.36",
"0.1.37",
"0.1.38",
"0.1.39",
"0.1.4",
"0.1.40",
"0.1.41",
"0.1.42",
"0.1.42rc1",
"0.1.43",
"0.1.44",
"0.1.45",
"0.1.46",
"0.1.47",
"0.1.47rc1",
"0.1.48",
"0.1.49",
"0.1.5",
"0.1.50",
"0.1.51",
"0.1.52",
"0.1.53",
"0.1.6",
"0.1.7",
"0.1.8",
"0.1.9",
"0.2.0",
"0.2.0rc1",
"0.2.1",
"0.2.10",
"0.2.11",
"0.2.12",
"0.2.13",
"0.2.15",
"0.2.16",
"0.2.17",
"0.2.18",
"0.2.19",
"0.2.2",
"0.2.20",
"0.2.21",
"0.2.22",
"0.2.23",
"0.2.24",
"0.2.25",
"0.2.26",
"0.2.27",
"0.2.28",
"0.2.29",
"0.2.29rc1",
"0.2.2rc1",
"0.2.3",
"0.2.30",
"0.2.31",
"0.2.32",
"0.2.33",
"0.2.34",
"0.2.35",
"0.2.36",
"0.2.37",
"0.2.38",
"0.2.39",
"0.2.4",
"0.2.40",
"0.2.41",
"0.2.42",
"0.2.43",
"0.2.5",
"0.2.6",
"0.2.7",
"0.2.8",
"0.2.9",
"0.3.0",
"0.3.0.dev0",
"0.3.0.dev1",
"0.3.0.dev2",
"0.3.0.dev3",
"0.3.0.dev4",
"0.3.0.dev5",
"0.3.1",
"0.3.10",
"0.3.11",
"0.3.12",
"0.3.13",
"0.3.14",
"0.3.15",
"0.3.16",
"0.3.17",
"0.3.18",
"0.3.19",
"0.3.2",
"0.3.20",
"0.3.21",
"0.3.22",
"0.3.23",
"0.3.24",
"0.3.25",
"0.3.26",
"0.3.27",
"0.3.28",
"0.3.29",
"0.3.3",
"0.3.30",
"0.3.31",
"0.3.32",
"0.3.33",
"0.3.34",
"0.3.34rc1",
"0.3.34rc2",
"0.3.35",
"0.3.36",
"0.3.37",
"0.3.38",
"0.3.39",
"0.3.4",
"0.3.40",
"0.3.41",
"0.3.42",
"0.3.43",
"0.3.44",
"0.3.45",
"0.3.45rc1",
"0.3.46",
"0.3.47",
"0.3.48",
"0.3.49",
"0.3.5",
"0.3.50",
"0.3.51",
"0.3.52",
"0.3.53",
"0.3.54",
"0.3.55",
"0.3.56",
"0.3.56rc1",
"0.3.57",
"0.3.58",
"0.3.59",
"0.3.6",
"0.3.60",
"0.3.61",
"0.3.62",
"0.3.63",
"0.3.64",
"0.3.65",
"0.3.66",
"0.3.67",
"0.3.68",
"0.3.69",
"0.3.7",
"0.3.70",
"0.3.71",
"0.3.72",
"0.3.73",
"0.3.74",
"0.3.75",
"0.3.76",
"0.3.77",
"0.3.78",
"0.3.79",
"0.3.8",
"0.3.80",
"0.3.81",
"0.3.82",
"0.3.83",
"0.3.84",
"0.3.85",
"0.3.86",
"0.3.9",
"0.4.0.dev0",
"1.0.0",
"1.0.0a1",
"1.0.0a2",
"1.0.0a3",
"1.0.0a4",
"1.0.0a5",
"1.0.0a6",
"1.0.0a7",
"1.0.0a8",
"1.0.0rc1",
"1.0.0rc2",
"1.0.0rc3",
"1.0.1",
"1.0.2",
"1.0.3",
"1.0.4",
"1.0.5",
"1.0.6",
"1.0.7",
"1.1.0",
"1.1.1",
"1.1.2",
"1.1.3",
"1.2.0",
"1.2.1",
"1.2.10",
"1.2.11",
"1.2.12",
"1.2.13",
"1.2.14",
"1.2.15",
"1.2.16",
"1.2.17",
"1.2.18",
"1.2.19",
"1.2.2",
"1.2.20",
"1.2.21",
"1.2.3",
"1.2.4",
"1.2.5",
"1.2.6",
"1.2.7",
"1.2.8",
"1.2.9"
]
}
],
"aliases": [
"CVE-2026-34070",
"GHSA-qh6h-p6c9-ff54"
],
"details": "LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.",
"id": "PYSEC-2026-2193",
"modified": "2026-07-13T05:49:27.273358Z",
"published": "2026-03-31T03:15:58.947Z",
"references": [
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-34070"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34070.json"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:24766"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2026:37275"
},
{
"type": "ADVISORY",
"url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453287"
},
{
"type": "FIX",
"url": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"
},
{
"type": "EVIDENCE",
"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…