CVE-2026-34070 & CVE-2025-67644 expose files, secrets & databases in LangChain (52M weekly downloads). Patch now — here
What these CVEs actually open up
CVE-2026-34070 and CVE-2025-67644 target two classic failure modes in agent and chain tooling: path traversal and SQL injection. In LangChain and LangGraph stacks, those failures are not abstract. Path traversal can turn a file-loading tool, document loader, or workspace helper into a reader for arbitrary paths on the host. SQL injection can turn a “natural language to query” path or a lightly sanitized database tool into a channel that reads or alters data the agent was never meant to touch.
Because LangChain sees on the order of 52 million weekly downloads, the same classes of bug surface across many products at once—internal copilots, support bots, RAG services, and automated ops agents. The shared risk is trust boundary collapse: user-controlled text or tool arguments reach filesystem and database APIs with too little validation.
Path traversal: treat every path as hostile
Path traversal succeeds when an application joins user input onto a base directory and then opens the result without enforcing that the final path stays inside an allowed root. In agent systems that is easy to miss: a “load this file” tool, a template path, a cache key, or a retrieval path can all accept relative segments such as ../ or absolute paths that escape the intended sandbox.
Practical defense is boring and effective. Resolve paths to absolute form, reject any path that does not stay under a configured allowlist root, and never pass raw user strings into open/read APIs. Prefer opaque file IDs over free-form paths. Disable or tightly scope filesystem tools in production agents unless they are required, and run those tools under a dedicated service account with minimal directory rights so a missed check still cannot reach secrets, config, or host credentials.
SQL injection: never let the model finish the query
SQL injection in LLM-backed apps often appears as “helpful” query construction: the model or a tool builder concatenates filters, table names, or ORDER BY clauses from untrusted text. Even parameterized queries fail if identifiers, sort keys, or multi-statement strings are still interpolated. Once that string hits the database, the agent becomes a proxy for reading secrets, dumping tables, or modifying rows.
Keep the model out of the raw SQL surface. Use parameterized queries for values, map user intent to a fixed set of allowed operations and columns, and reject free-form SQL from tools unless it is executed against a read-only role with row- and column-level limits. Prefer query builders or stored procedures with explicit parameters over string templates. Log the final statement shape (not necessarily full parameter values) so you can audit what the agent actually ran.
- Inventory every tool that can touch disk or SQL and mark which accept untrusted input.
- Apply path allowlists and SQL parameterization at the tool boundary, not only in prompts.
- Run agents with least privilege: separate credentials for file and database access.
- Patch LangChain/LangGraph dependencies promptly, then retest your own tool wrappers.
Patch, then re-check your glue code
Upstream fixes for CVE-2026-34070 and CVE-2025-67644 matter, but they do not replace application-level controls. Upgrade the affected packages as soon as your dependency chain allows, rebuild, and redeploy so production no longer ships the vulnerable code path. After patching, re-review custom loaders, retrievers, SQL tools, and any “execute what the model returns” helpers you added outside the core library.
Security for agent frameworks is mostly about reducing what tools can do when prompts fail. If a path cannot escape its root and a query cannot become arbitrary SQL, exposure of files, secrets, and databases drops sharply—even when the model is jailbroken or the user is adversarial. Patch now, then keep those boundaries hard in your own stack.