CVE-2026-34070

Published Mar 31, 2026

Last updated 6 days ago

CVSS high 7.5

Overview

Description
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
Source
security-advisories@github.com
NVD status
Modified
Products
langchain_core

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity
HIGH

Weaknesses

security-advisories@github.com
CWE-22
0b0ca135-0b70-47e7-9f44-1890c2a1c46c
CWE-22

Social media

Hype score
Not currently trending

  1. 3 critical LangChain CVEs just dropped. CVE-2026-34070: path traversal (CVSS 7.5) CVE-2025-68664: API key leakage (CVSS 9.3) CVE-2025-67644: SQL injection (CVSS 7.3) 52 million downloads/week. When did you last test your LangChain agent? pip install crucible-security Link in Bio

    @Crucible_Sec

    25 Apr 2026

    1 Impression

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 3 serious CVEs just dropped for LangChain + LangGraph: - CVE-2025-68664 (CVSS 9.3): API keys & env secrets leak via unsafe deserialization - CVE-2026-34070 (CVSS 7.5): Path traversal -- arbitrary file read - CVE-2025-67644 (CVSS 7.3): SQL injection into conversation history

    @NYsquaredAI

    4 Apr 2026

    256 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Three vulnerabilities in LangChain & LangGraph: path traversal flaw (CVE-2026-34070, CVSS 7.5) exposed files, deserialization bug (CVE-2025-68664, CVSS 9.3) leaked API keys. #security #LangChain #LangGraph

    @bigmacd16684

    30 Mar 2026

    143 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

Configurations

Related CVEs

  1. LangChain is a framework for building agents and LLM-powered applications. Prior to 0.3.84 and 1.2.28, LangChain's f-string prompt-template validation was incomplete in two respects. First, some prompt template classes accepted f-string templates and formatted them without enforcing the same attribute-access validation as PromptTemplate. In particular, DictPromptTemplate and ImagePromptTemplate could accept templates containing attribute access or indexing expressions and subsequently evaluate those expressions during formatting. Second, f-string validation based on parsed top-level field names did not reject nested replacement fields inside format specifiers. In this pattern, the nested replacement field appears in the format specifier rather than in the top-level field name. As a result, earlier validation based on parsed field names did not reject the template even though Python formatting would still attempt to resolve the nested expression at runtime. This vulnerability is fixed in 0.3.84 and 1.2.28.•CVE-2026-40087
  2. LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.•CVE-2026-26013
  3. LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data. This issue has been patched in versions 0.3.81 and 1.2.5.•CVE-2025-68664

References

Sources include official advisories and independent security research.