CVE-2026-34070 & CVE-2025-67644 expose files, secrets & databases in LangChain (52M weekly downloads). Patch now — here
Two vulnerabilities, two classic attack classes
LangChain and LangGraph are affected by a pair of tracked security issues: CVE-2026-34070, a path traversal flaw, and CVE-2025-67644, a SQL injection flaw. Between them they map to two of the oldest and most reliable techniques an attacker has: reading files that should never be reachable, and issuing database queries that were never intended. Because these libraries sit at the center of agent and retrieval pipelines, a weakness here is not confined to one endpoint — it rides along with every chain, tool, and graph node that touches the vulnerable code path.
The reach matters. With roughly 52 million weekly downloads, LangChain is embedded in a large number of production systems, internal tools, and prototypes that quietly became load-bearing. A dependency that common turns a single library CVE into a broad, shared exposure.
What each flaw actually exposes
Path traversal (CVE-2026-34070) is about escaping an intended directory. When user- or model-controlled input is used to build a file path without strict validation, sequences that walk up the directory tree can pull back files outside the boundary the application assumed — configuration, credentials, keys, or other application data. In an agent context this is especially dangerous, because the "user input" can be text produced by a model or an upstream tool, not just a person typing in a form.
SQL injection (CVE-2025-67644) is about breaking out of a query's intended structure. If input is concatenated into SQL rather than passed as a bound parameter, an attacker can read, modify, or exfiltrate database contents. In LangChain-style deployments this often means the data store behind retrieval or an SQL-query tool — the exact place where sensitive records tend to live.
Patch now, then verify
The immediate action is to upgrade LangChain and LangGraph to fixed releases and redeploy. Pin the patched versions in your lockfile so a later reinstall doesn't silently reintroduce the vulnerable code, and rebuild any container images or serverless bundles that vendored the old dependency. If you cannot patch instantly, treat the affected paths as hostile and add validation in front of them as a stopgap.
- Inventory every service that depends on LangChain or LangGraph, directly or transitively, and confirm the resolved version.
- Upgrade to the fixed releases, then rebuild and redeploy — don't rely on a running process picking up the change.
- Constrain file access to an explicit allowlist and resolve paths to a canonical form before use.
- Use parameterized queries everywhere; never build SQL by string concatenation from model or user input.
- Review logs and database audit trails for traversal patterns or anomalous queries in case the flaws were already probed.
Design so the next CVE hurts less
Both flaws share a root cause: input that reached a sensitive operation without a trust boundary in between. Treat model output and tool results as untrusted the same way you treat raw user input, because in an agent they flow into the same file and database calls. Run these components with least privilege — a database role scoped to only the tables it needs, and file access confined to a dedicated directory — so a future bug leaks far less.
Fast, boring dependency hygiene is the real defense here: automated alerts on advisories, a lockfile you actually update, and a redeploy path you can trigger the day a fix lands rather than the week after.