Vulnerability	Vulnerable Version
H Directory Traversal langchain-core is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Directory Traversal via the `load_prompt`, `load_prompt_from_config`, or `.save()` methods on prompt classes. An attacker can access arbitrary files on the host filesystem by supplying crafted configuration data that includes absolute paths or directory traversal sequences. This allows reading files with specific extensions such as `.txt`, `.json`, or `.yaml` outside the intended directory structure. How to fix Directory Traversal? Upgrade `langchain-core` to version 1.2.22 or higher.	[,1.2.22)

Directory Traversal

langchain-core is a Building applications with LLMs through composability

Affected versions of this package are vulnerable to Directory Traversal via the load_prompt, load_prompt_from_config, or .save() methods on prompt classes. An attacker can access arbitrary files on the host filesystem by supplying crafted configuration data that includes absolute paths or directory traversal sequences. This allows reading files with specific extensions such as .txt, .json, or .yaml outside the intended directory structure.

How to fix Directory Traversal?

Upgrade langchain-core to version 1.2.22 or higher.

[,1.2.22)

Go back to all versions of this package