LangChain is a framework for building agents and LLM-powered applications.
CVE-2026-34070
Summary Multiple functions in langchaincore.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to loadprompt() or loadpromptfromconfig(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). Note: The affected functions (loadprompt, loadpromptfromconfig, and the .save() method on prompt classes) are undocumented legacy APIs. They are superseded by the dumpd/dumps/load/loads serialization APIs in langchaincore.load, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0. Affected component Package: langchain-core File: langchaincore/prompts/loading.py Affected functions: loadtemplate(), loadexamples(), loadfewshotprompt() Severity High The score reflects the file-extension constraints that limit which files can be read. Vulnerable code paths | Config key | Loaded by | Readable extensions | |---|---|---|…
Proof-of-concept code is published
Public PoC
- Public PoCRickidevs/CVE-2026-34070
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Part of the AI stack
This affects LangChain, in Agent frameworks.
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- EPSS
- 1.44% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 27 March 2026
- Last updated
- 25 August 2026
- Affected
- langchain-ai · langchain · langchain-core
- Weakness
- CWE-22
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
At the source
References
- https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
- https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22
- https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54
- https://access.redhat.com/errata/RHSA-2026:24766
- https://access.redhat.com/errata/RHSA-2026:37275
- https://access.redhat.com/errata/RHSA-2026:59159
- https://access.redhat.com/security/cve/CVE-2026-34070
- https://bugzilla.redhat.com/show_bug.cgi?id=2453287
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34070.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-34070
- https://github.com/advisories/GHSA-qh6h-p6c9-ff54
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-34070