PyPI/langchain-core CVE-2026-34070: high 7.5, EPSS 1.38%

LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions

Action: Upgrade langchain-core to 1.2.22 or later.

pip install langchain-core==1.2.22

Affected

Fixed versions

Sources

• osv: GHSA-qh6h-p6c9-ff54
• https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54
• https://nvd.nist.gov/vuln/detail/CVE-2026-34070
• https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22

CVE-2026-34070 · published 2026-03-27T19:45:00Z · modified 2026-09-10T03:50:40.646863770Z · JSON