{"action":"Upgrade langchain-core to 1.2.22 or later.","affected":[{"fixed":"1.2.22","introduced":"0"}],"component":"langchain-core","cve_ids":["CVE-2026-34070"],"ecosystem":"PyPI","epss":0.01382,"exploited":false,"fixed_versions":["1.2.22"],"ghsa_id":"GHSA-qh6h-p6c9-ff54","id":"tcs_01M5KFW49FSN06DFC78HKGDHHA","modified_at":"2026-09-10T03:50:40.646863770Z","published_at":"2026-03-27T19:45:00Z","references":["https://osv.dev/vulnerability/GHSA-qh6h-p6c9-ff54","https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54","https://nvd.nist.gov/vuln/detail/CVE-2026-34070","https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c","https://github.com/langchain-ai/langchain","https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-qh6h-p6c9-ff54","url":"https://osv.dev/vulnerability/GHSA-qh6h-p6c9-ff54"}],"summary":"LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions"}