Skip to content

Commit b0fee29

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-c4r5-fxqw-vh93 GHSA-qh6h-p6c9-ff54
1 parent 47d95d3 commit b0fee29

2 files changed

Lines changed: 126 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-c4r5-fxqw-vh93/GHSA-c4r5-fxqw-vh93.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c4r5-fxqw-vh93",
4+
"modified": "2026-03-27T19:43:14Z",
5+
"published": "2026-03-27T19:43:14Z",
6+
"aliases": [
7+
"CVE-2026-34060"
8+
],
9+
"summary": "Ruby LSP has arbitrary code execution through branch setting",
10+
"details": "**Summary**\n\nThe `rubyLsp.branch` VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a user opens a project containing a malicious `.vscode/settings.json`.\n\nOther editors that support workspace setting that get automatically applied upon opening the editor and trusting the workspace are also impacted since the server is the component that performs the interpolation.\n\n**Details**\n\nThe `branch` CLI argument passed to the `ruby-lsp` server was interpolated in the generated `.ruby-lsp/Gemfile` without sanitization. Editors that allow defining settings saved at the workspace level (e.g.: `.vscode/settings.json`) that gets automatically applied open the possibility to craft a malicious repository that once opened and trusted in the editor would run arbitrary code.\n\n**Impact**\n\nCode execution with the privileges of the user who opens the malicious project. Ruby LSP assumes workspace code is trusted and so opening the editor on an untrusted workspace can lead to executing potentially dangerous code.\n\n**Remediation**\n\nThe `rubyLsp.branch` setting has been removed entirely. VS Code extensions auto-update by default, so most users will receive the fix without action. Users who have disabled auto-updates should update to extension version >= 0.10.2.\n\nThe `branch` CLI flag was also entirely removed from the `ruby-lsp` gem. For users that don't add `ruby-lsp` to their Gemfiles, the server should auto-update. Users with the `ruby-lsp` in the Gemfile and locked to a specific version should update to >= 0.26.9.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "ruby-lsp"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "0.26.9"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/Shopify/ruby-lsp"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-94"
55+
],
56+
"severity": "HIGH",
57+
"github_reviewed": true,
58+
"github_reviewed_at": "2026-03-27T19:43:14Z",
59+
"nvd_published_at": null
60+
}
61+
}

‎advisories/github-reviewed/2026/03/GHSA-qh6h-p6c9-ff54/GHSA-qh6h-p6c9-ff54.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qh6h-p6c9-ff54",
4+
"modified": "2026-03-27T19:45:01Z",
5+
"published": "2026-03-27T19:45:00Z",
6+
"aliases": [
7+
"CVE-2026-34070"
8+
],
9+
"summary": "LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functions",
10+
"details": "## Summary\n\nMultiple functions in `langchain_core.prompts.loading` read files from paths embedded in deserialized config dicts without validating against directory traversal or absolute path injection. When an application passes user-influenced prompt configurations to `load_prompt()` or `load_prompt_from_config()`, an attacker can read arbitrary files on the host filesystem, constrained only by file-extension checks (`.txt` for templates, `.json`/`.yaml` for examples).\n\n**Note:** The affected functions (`load_prompt`, `load_prompt_from_config`, and the `.save()` method on prompt classes) are undocumented legacy APIs. They are superseded by the `dumpd`/`dumps`/`load`/`loads` serialization APIs in `langchain_core.load`, which do not perform filesystem reads and use an allowlist-based security model. As part of this fix, the legacy APIs have been formally deprecated and will be removed in 2.0.0.\n\n## Affected component\n\n**Package:** `langchain-core`\n**File:** `langchain_core/prompts/loading.py`\n**Affected functions:** `_load_template()`, `_load_examples()`, `_load_few_shot_prompt()`\n\n## Severity\n\n**High** \n\nThe score reflects the file-extension constraints that limit which files can be read.\n\n## Vulnerable code paths\n\n| Config key | Loaded by | Readable extensions |\n|---|---|---|\n| `template_path`, `suffix_path`, `prefix_path` | `_load_template()` | `.txt` |\n| `examples` (when string) | `_load_examples()` | `.json`, `.yaml`, `.yml` |\n| `example_prompt_path` | `_load_few_shot_prompt()` | `.json`, `.yaml`, `.yml` |\n\nNone of these code paths validated the supplied path against absolute path injection or `..` traversal sequences before reading from disk.\n\n## Impact\n\nAn attacker who controls or influences the prompt configuration dict can read files outside the intended directory:\n\n- **`.txt` files:** cloud-mounted secrets (`/mnt/secrets/api_key.txt`), `requirements.txt`, internal system prompts\n- **`.json`/`.yaml` files:** cloud credentials (`~/.docker/config.json`, `~/.azure/accessTokens.json`), Kubernetes manifests, CI/CD configs, application settings\n\nThis is exploitable in applications that accept prompt configs from untrusted sources, including low-code AI builders and API wrappers that expose `load_prompt_from_config()`.\n\n## Proof of concept\n\n```python\nfrom langchain_core.prompts.loading import load_prompt_from_config\n\n# Reads /tmp/secret.txt via absolute path injection\nconfig = {\n \"_type\": \"prompt\",\n \"template_path\": \"/tmp/secret.txt\",\n \"input_variables\": [],\n}\nprompt = load_prompt_from_config(config)\nprint(prompt.template) # file contents disclosed\n\n# Reads ../../etc/secret.txt via directory traversal\nconfig = {\n \"_type\": \"prompt\",\n \"template_path\": \"../../etc/secret.txt\",\n \"input_variables\": [],\n}\nprompt = load_prompt_from_config(config)\n\n# Reads arbitrary .json via few-shot examples\nconfig = {\n \"_type\": \"few_shot\",\n \"examples\": \"../../../../.docker/config.json\",\n \"example_prompt\": {\n \"_type\": \"prompt\",\n \"input_variables\": [\"input\", \"output\"],\n \"template\": \"{input}: {output}\",\n },\n \"prefix\": \"\",\n \"suffix\": \"{query}\",\n \"input_variables\": [\"query\"],\n}\nprompt = load_prompt_from_config(config)\n```\n\n## Mitigation\n\n**Update `langchain-core` to >= 1.2.22.**\n\nThe fix adds path validation that rejects absolute paths and `..` traversal sequences by default. An `allow_dangerous_paths=True` keyword argument is available on `load_prompt()` and `load_prompt_from_config()` for trusted inputs.\n\nAs described above, these legacy APIs have been formally deprecated. Users should migrate to `dumpd`/`dumps`/`load`/`loads` from `langchain_core.load`.\n\n## Credit\n\n- [jiayuqi7813](https://github.com/jiayuqi7813) reporter\n- [VladimirEliTokarev](https://github.com/VladimirEliTokarev) reporter\n- [Rickidevs](https://github.com/Rickidevs) reporter\n- Kenneth Cox (cczine@gmail.com) reporter",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "langchain-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.2.22"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-qh6h-p6c9-ff54"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/langchain-ai/langchain/commit/27add913474e01e33bededf4096151130ba0d47c"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/langchain-ai/langchain"
50+
},
51+
{
52+
"type": "WEB",
53+
"url": "https://github.com/langchain-ai/langchain/releases/tag/langchain-core==1.2.22"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-22"
59+
],
60+
"severity": "HIGH",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-27T19:45:00Z",
63+
"nvd_published_at": null
64+
}
65+
}

0 commit comments

Comments
 (0)