2026-03-17 · 2026-Q1
LangChain Core Path Traversal
PrimaryL5Config
- Fixable:
- Yes, vendor patch
- Vendor response:
- Patched
- In the wild:
- No
- Actor:
- Attacker
Target
LangChain Core
Impact
Arbitrary file access via prompt-loading API
Root Cause
Path traversal in prompt loading