CVE-2026-34070

What it actually does

This vulnerability allows arbitrary local file read through path traversal or absolute path injection in LangChain prompt-loading code. Before LangChain version 1.2.22, functions in langchain_core.prompts.loading, including load_prompt() and load_prompt_from_config(), could deserialize prompt configuration dictionaries containing file paths and then read those paths without adequately restricting them to an intended directory. If an application accepts user-controlled or user-influenced prompt configuration data, an unauthenticated remote attacker may cause the application process to read files from the host filesystem, limited by the vulnerable loader’s file-extension expectations such as .txt for prompt templates and .json/.yaml for examples. The primary impact is confidentiality loss; the flaw does not directly provide code execution, data modification, or denial of service.

Why it matters to the business

Applications using affected LangChain prompt-loading functionality may expose sensitive local files such as application configuration, prompt assets, JSON or YAML secrets, deployment metadata, or operational documentation if attackers can influence prompt configuration input. This can lead to credential leakage, exposure of proprietary prompts or internal application logic, and follow-on compromise of connected systems. The CVSS score of 7.5 reflects high confidentiality impact, while the current EPSS value is low and the vulnerability is not listed in CISA KEV, so remediation should be prioritized for internet-facing or multi-tenant AI applications that accept external prompt configuration data.

How an attack unfolds

An attacker first identifies an application feature, API endpoint, workflow, plugin system, or agent configuration interface that passes user-supplied prompt configuration data into LangChain’s load_prompt() or load_prompt_from_config(). The attacker then submits a crafted configuration dictionary containing a relative traversal path such as ../../ paths or an absolute filesystem path. Because affected versions do not sufficiently validate the path before opening the referenced file, the application reads the attacker-selected local file if it satisfies the relevant extension check. The file contents may then be returned directly in an error, rendered into a prompt, included in model context, logged, or exposed through downstream application behavior. The attacker repeats this process to enumerate readable .txt, .json, .yaml, or .yml files containing credentials, application configuration, prompt templates, or other sensitive information.

How to fix it

Upgrade LangChain / langchain-core to version 1.2.22 or later wherever prompt-loading functionality is used. If packages are pinned, update dependency lockfiles and rebuild affected application artifacts such as containers, serverless bundles, and virtual environments. As defense in depth, do not pass untrusted prompt configuration dictionaries directly into load_prompt() or load_prompt_from_config(); validate configuration schemas, reject absolute paths, normalize and canonicalize paths, and enforce an allowlist of approved prompt directories. Run AI application processes with least-privilege filesystem access and avoid placing secrets in files with extensions likely to be read by prompt loaders, such as .json, .yaml, .yml, or .txt, unless required. Where immediate upgrade is not possible, disable user-supplied prompt loading, wrap vulnerable calls with strict path validation, and constrain runtime filesystem access using containers, read-only mounts, chroot-like isolation, AppArmor, SELinux, or equivalent controls.

How to confirm the fix worked

Confirm the deployed LangChain or langchain-core version is 1.2.22 or later using package inventory, lockfiles, runtime package inspection, and container image scanning. Review code for calls to langchain_core.prompts.loading.load_prompt(), load_prompt(), and load_prompt_from_config(), then verify that no user-controlled data can reach those functions without strict validation. Test representative application entry points by submitting benign traversal payloads that reference non-sensitive test files with allowed extensions outside the intended prompt directory; the fixed or mitigated application should reject the request and should not read or disclose the file. Validate that dependency updates are present in all build artifacts, not only source repositories. Also confirm that application service accounts cannot read unnecessary configuration, secret, or source files from the local filesystem.

Typical attack path

1. Find an application using LangChain prompt-loading features that accepts externally supplied or user-influenced prompt configuration data.
2. Craft a prompt configuration containing a path traversal sequence or absolute path pointing to a local file readable by the application process.
3. Ensure the target file path matches the vulnerable loader’s accepted file-extension behavior, commonly .txt, .json, .yaml, or .yml depending on the code path.
4. Submit the malicious configuration through an API request, uploaded config, workflow definition, agent plugin, or prompt-management interface.
5. Observe whether the application returns, logs, embeds, or otherwise exposes the local file contents.
6. Use disclosed configuration files, secrets, prompts, or deployment details to support further intrusion, credential theft, or lateral movement.

How to detect it

Detection depends heavily on how the application exposes prompt loading, because exploitation occurs through application-specific configuration input rather than a universal network signature. Review HTTP access logs, API gateway logs, application logs, prompt-management audit logs, workflow/plugin upload logs, and LLM orchestration traces for configuration fields containing directory traversal sequences, absolute paths, or references to sensitive local files. Look for requests or errors involving load_prompt(), load_prompt_from_config(), langchain_core.prompts.loading, template paths, example paths, or unexpected local file reads. Investigate responses, model traces, debug logs, and exception logs that contain contents of local .txt, .json, .yaml, or .yml files. Correlate suspicious requests with subsequent authentication failures, secret use, cloud API calls, repository access, or administrative activity. If exploitation is suspected, preserve application logs and containers, identify files readable by the application process, determine whether sensitive configuration files were accessed, and rotate any credentials that may have been exposed.

• ../
• ..\\
• %2e%2e%2f
• %2e%2e%5c
• %252e%252e%252f
• /etc/
• /proc/
• /var/run/secrets/
• /run/secrets/
• /app/config.json
• /app/config.yaml
• /app/config.yml
• /app/secrets.json
• /app/secrets.yaml
• /app/secrets.yml
• /config.json
• /config.yaml
• /config.yml
• /secrets.json
• /secrets.yaml
• /secrets.yml
• C:\\Windows\\
• C:\\Users\\
• C:\\ProgramData\\
• load_prompt(
• load_prompt_from_config(
• langchain_core.prompts.loading
• template_path
• template_file
• examples_path
• examples_file

What your security team should do

• Prioritize upgrade to LangChain / langchain-core 1.2.22 or later for internet-facing, multi-tenant, plugin-enabled, or externally configurable AI applications.
• Inventory all applications using LangChain prompt-loading APIs and identify any path where users, integrations, uploaded files, agents, or workflow definitions can influence prompt configuration dictionaries.
• Temporarily disable or restrict user-supplied prompt configuration loading until affected components are patched and validated.
• Add centralized input validation that rejects absolute paths, parent-directory traversal, URL-style file references, and paths outside an explicit prompt directory allowlist.
• Harden runtime permissions so application processes cannot read secrets, deployment manifests, source repositories, or unrelated configuration files.
• Search application and access logs for suspicious path traversal attempts, absolute filesystem paths, and requests referencing sensitive .json, .yaml, .yml, or .txt files.
• Add regression tests for prompt-loading path validation to prevent reintroduction of unsafe file reads.
• Review any potentially exposed configuration files for embedded credentials and rotate secrets if exploitation is suspected.