LangChain core prompt-loading path traversal (langchain_core/prompts/loading.py)
Date: 2026-03
Affected: langchain-core (multiple versions)
Attack vector: path-traversal
Category: real-world
Severity: High
CVE: CVE-2026-34070
CWE: CWE-22
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Path traversal in LangChain core's prompt-loading API (langchain_core/prompts/loading.py) allowing access to arbitrary files without validation by supplying a specially crafted prompt template. CVSS 7.5.


Mitigations:

Architectural layers (MAESTRO):