LangChain: prompt config files are loaded from unvalidated paths, letting a caller read arbitrary host files

Impact

Several functions in langchain_core.prompts.loading read files from paths embedded in a deserialized config dict without checking for directory traversal or absolute paths. Any application that lets user-influenced prompt configuration reach load_prompt() or load_prompt_from_config() hands the caller arbitrary file reads on the host, bounded only by extension checks: .txt for templates, .json and .yaml for examples. On a GPU node that is a real reach - service account tokens, kubeconfigs and mounted secrets are frequently JSON or YAML, and a serving pod usually runs with credentials that matter beyond itself. The record describes disclosure only; there is no write or execution primitive here.

Who can reach it

Anyone who can influence the prompt configuration an application passes to the loader - a tenant-supplied prompt template, an agent config pulled from a shared store, a prompt registry entry. Whether authentication is required depends on the calling application; the library itself imposes no check.

What to do

Upgrade langchain-core to 1.2.22 and restart the serving processes that import it. This is a Python dependency bump, so the cost is a rebuilt image and a rolling restart of inference or agent workers - no node drain. If you cannot upgrade immediately, stop passing externally-influenced config dicts to load_prompt()/load_prompt_from_config() and resolve prompt file paths yourself against an allowlisted directory. Red Hat has shipped errata for OpenShift AI and Ansible Automation Platform builds that vendor the library.

References

Related entries

• vLLM (activation function loading): Assert-based security check bypass, unauthenticatedCVE-2026-41523 · vLLM (activation function loading)High
• Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
• NVIDIA NemoClaw for Linux: installer downloads code without an integrity checkCVE-2026-65097 · NVIDIA NemoClaw for Linux (installation scripts)High
• Ollama (GGUF metadata parser): Uncontrolled memory allocationCVE-2026-65315 · Ollama (GGUF metadata parser)High
• Milvus: Unauthenticated DoS terminating service componentsCVE-2026-69111 · MilvusHigh
• BentoML 1.3.9 (bundled Gradio app, /login endpoint): The /login endpoint of the integrated Gradio app processes eachNCVD-2025-016-bentoml-1-3-9-bundled-gradio-app · BentoML 1.3.9 (bundled Gradio app, /login endpoint)High