CVE-2026-34070

🗓️ 31 Mar 2026 02:01:49Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 247 Views🌐 WEB

LangChain Core path traversal in legacy load prompt allowed reading files; fixed in version 1.2.22.

Reporter	Title	Published	Views	Family All 41
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	5 May 202614:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes April 2026	27 May 202615:10	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	30 Jun 202607:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses langchain_core-0.3.86-py3-none-any.whl which is vulnerable to CVE-2026-34070	5 Aug 202613:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a path traversal in LangChain [CVE-2026-34070]	21 May 202615:23	–	ibm
GithubExploit	Exploit for CVE-2026-34070	26 Mar 202613:39	–	githubexploit
ATTACKERKB	CVE-2026-34070	31 Mar 202602:01	–	attackerkb
Chainguard	CVE-2026-34070 vulnerabilities	11 Apr 202614:18	–	cgr
Circl	CVE-2026-34070	26 Mar 202613:13	–	circl
CNNVD	LangChain 安全漏洞	31 Mar 202600:00	–	cnnvd

NVD

Vulners

Node

langchain langchain_coreRange<1.2.22python

[
  {
    "vendor": "langchain-ai",
    "product": "langchain",
    "versions": [
      {
        "version": "< 1.2.22",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22
github	www.github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
github	www.github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54
access	www.access.redhat.com/errata/RHSA-2026:37275
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34070.json
access	www.access.redhat.com/security/cve/CVE-2026-34070
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/errata/RHSA-2026:24766
access	www.access.redhat.com/errata/RHSA-2026:59159

Parameter	Position	Path	Description	CWE
template_path	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
examples	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
example_prompt_path	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
prefix	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
suffix	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
_type	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
input_variables	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22
template	request body	load_prompt_from_config	Path traversal via user-influenced prompt config leading to arbitrary file reads	CWE-22

25 Aug 2026 13:18Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

EPSS0.01382

SSVC

CWE-22