The vulnerability in LangChain Core allows an attacker to read arbitrary files on the host file system. The flaw exists in several legacy prompt loading functions that deserialize configuration dictionaries and then open files based on path entries. The code does not sanitize these paths for directory traversal or absolute path injection. An attacker who can influence prompt configuration parameters can cause the application to read any file with an allowed extension (such as .txt, .json, or .yaml), potentially exposing sensitive data. This weakness corresponds to a path traversal flaw (CWE‑22).

The affected product is LangChain Core supplied by langchain-ai. Versions earlier than 1.2.22 are vulnerable. All environments running those versions that invoke load_prompt or load_prompt_from_config with user‑controlled configuration data are impacted.

The CVSS score is 7.5, indicating a high severity. The EPSS score is very low (<1%), suggesting that exploitation is currently uncommon in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw through any interface that accepts prompt configuration data, which can be supplied by end users or third‑party integrations. No special privileges are required beyond the application’s runtime context, so the risk depends on the trust level of the data source.