A critical path traversal vulnerability in the LangChain framework allows unauthenticated attackers to read sensitive files from the host filesystem, posing a significant risk to data confidentiality.

This vulnerability occurs due to improper validation of file paths in the langchain_core.prompts.loading module, where deserialized configuration dictionaries permit directory traversal or absolute path injection. This flaw is reachable by unauthenticated attackers who can supply user-influenced prompt configurations to the load_prompt() or load_prompt_from_config() functions.

The ability for an unauthenticated attacker to read arbitrary files on the host system presents a severe risk of information disclosure, including the theft of environment variables, credentials, or sensitive application data. With a CVSS score of 7.5, this high-severity vulnerability could lead to a full compromise of the application environment and subsequent lateral movement within the infrastructure.

Immediate Action: Update the langchain-core package to version 1.2.22 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review application logs for unexpected requests to the load_prompt or load_prompt_from_config functions, particularly those containing encoded path characters or suspicious directory references.

Compensating Controls: Implement strict input validation and sanitization for all prompt configuration inputs and ensure that the application process operates with the principle of least privilege, limiting file system access to essential directories only.

Public Exploit Available: Yes, a public proof-of-concept repository is available on GitHub.

Given the availability of public proof-of-concept code and the ease of exploitation via unauthenticated network access, immediate action is required. Organizations utilizing the LangChain framework must prioritize updating to version 1.2.22 to remediate this path traversal flaw and protect sensitive system files from unauthorized access.