https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:23:52.023615+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-34070 CVE-2026-34070 — LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions 2026-10-02T23:23:52.025334+00:00

Affected: langchain-ai langchain, Red Hat Ansible Automation Platform 2.5, Red Hat OpenShift AI 3.3, Red Hat OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI)

LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.

 https://cve.radiocsirt.org/vuln/ghsa-qh6h-p6c9-ff54 GHSA-qh6h-p6c9-ff54 — LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions 2026-10-02T23:23:52.025407+00:00

Affected: PyPI: langchain-core

## Summary

Multiple functions in `langchain_core.prompts.loading` read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to `load_prompt()` or `load_prompt_from_config()`, an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (`.txt` for templates, `.json`/`.yaml` for examples).

**Note:** The affected functions (`load_prompt`, `load_prompt_from_config`, and the `.save()` method on prompt classes) are undocumented legacy APIs. They are superseded by the `dumpd`/`dumps`/`load`/`loads` serialization APIs in `langchain_core.load`, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0.

## Affected component

**Package:** `langchain-core` **File:** `langchain_core/prompts/loading.py` **Affected functions:** `_load_template()`, `_load_examples()`, `_load_few_shot_prompt()`

## Severity

**High**

The score reflects the file-extension constraints that limit which files can be read.

## Vulnerable code paths

| Config key | Loaded by | Readable extensions | |---|---|---| | `template_path`, `suffix_path`, `prefix_path` | `_load_template()` | `.txt` | | `examples` (when string) | `_load_examples()` | `.json`, `.yaml`, `.yml` | | `example_prompt_path` | `_load_few_shot_pr…