CVE-2026-34070

CVE-2026-34070 is a high-severity directory traversal and absolute path injection vulnerability affecting LangChain versions prior to 1.2.22. It allows an unauthenticated, remote attacker to read arbitrary files on the host filesystem by providing malicious prompt configurations to `load_prompt()` or `load_prompt_from_config()`. Rated 7.5 CVSS, this vulnerability has low attack complexity and requires no user interaction, leading to a high confidentiality impact. While there is community discussion and media coverage, no active exploitation or public exploit code has been identified.