Описание
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
A flaw was found in LangChain. Multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized configuration dictionaries without validation for directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem.
Отчет
This flaw is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose load_prompt_from_config().
Also, the affected functions (load_prompt, load_prompt_from_config and the .save() method on prompt classes) are undocumented legacy APIs. They are superseded by the dumpd/dumps/load/loads serialization APIs in langchain_core.load, which do not perform filesystem reads and use an allowlist-based security model.
An attacker who controls or influences the prompt configuration dictionary can read files outside the intended directory, such as cloud-mounted secrets, internal system prompts, cloud credentials, Kubernetes manifests, CI/CD configs and application settings.
Due to these reasons, this vulnerability has been rated with an important severity.
Меры по смягчению последствий
As described in the statement section, the vulnerable methods are legacy APIs and their use should be avoided. To mitigate this issue, the dumpd, dumps, load and loads methods from langchain_core.load should be used, as they supersede the legacy API and provide a more secure serialization model.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Lightspeed | openshift-lightspeed/lightspeed-service-api-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/lightspeed-chatbot-rhel8 | Will not fix | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/lightspeed-rhel9 | Will not fix | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2.5 | ansible-automation-platform-25/lightspeed-rhel8 | Fixed | RHSA-2026:24766 | 09.06.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-llama-stack-core-rhel9 | Fixed | RHSA-2026:37275 | 09.07.2026 |
| Red Hat OpenShift AI 3.3 | rhoai/odh-trustyai-nemo-guardrails-server-rhel9 | Fixed | RHSA-2026:37275 | 09.07.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
LangChain is a framework for building agents and LLM-powered applications. Prior to version 1.2.22, multiple functions in langchain_core.prompts.loading read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to load_prompt() or load_prompt_from_config(), an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (.txt for templates, .json/.yaml for examples). This issue has been patched in version 1.2.22.
LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions
EPSS
7.5 High
CVSS3