{"record":{"id":"961c0287e81ab59b","repo":"langchain-ai/langchain","slug":"loading-images-from-path-has-been-removed-as-of","errorCode":null,"errorMessage":"Loading images from 'path' has been removed as of 0.3.15 for security reasons. Please specify images by 'url'.","messagePattern":"Loading images from 'path' has been removed as of 0\\.3\\.15 for security reasons\\. Please specify images by 'url'\\.","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"libs/core/langchain_core/prompts/image.py","lineNumber":140,"sourceCode":"            ```python\n            prompt.format(variable1=\"foo\")\n            ```\n        \"\"\"\n        formatted = {}\n        for k, v in self.template.items():\n            if isinstance(v, str):\n                formatted[k] = DEFAULT_FORMATTER_MAPPING[self.template_format](\n                    v, **kwargs\n                )\n            else:\n                formatted[k] = v\n        url = kwargs.get(\"url\") or formatted.get(\"url\")\n        if kwargs.get(\"path\") or formatted.get(\"path\"):\n            msg = (\n                \"Loading images from 'path' has been removed as of 0.3.15 for security \"\n                \"reasons. Please specify images by 'url'.\"\n            )\n            raise ValueError(msg)\n        detail = kwargs.get(\"detail\") or formatted.get(\"detail\")\n        if not url:\n            msg = \"Must provide url.\"\n            raise ValueError(msg)\n        if not isinstance(url, str):\n            msg = \"url must be a string.\"\n            raise ValueError(msg)  # noqa: TRY004\n        output: ImageURL = {\"url\": url}\n        if detail:\n            # Don't check literal values here: let the API check them\n            output[\"detail\"] = cast(\"Literal['auto', 'low', 'high']\", detail)\n        return output\n\n    async def aformat(self, **kwargs: Any) -> ImageURL:\n        \"\"\"Async format the prompt with the inputs.\n\n        Args:\n            **kwargs: Any arguments to be passed to the prompt template.","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/langchain-ai/langchain/blob/e32fa9a52eab3b61ad7a45399bfde59b3e580fc4/libs/core/langchain_core/prompts/image.py#L122-L158","documentation":"`ImagePromptTemplate.format()` refuses any value for `path` supplied via kwargs or the rendered template. Loading images from local file paths was removed in langchain-core 0.3.15 because it enabled reading arbitrary local files (path traversal / local file exfiltration); images must now be referenced by `url` (which may be a base64 data URL).","triggerScenarios":"Calling `format(path='/tmp/img.png')`, or having `template={'path': '{img_path}'}` render to a truthy value, on langchain-core >= 0.3.15.","commonSituations":"Upgrading from langchain-core < 0.3.15 where local-path images worked; multimodal agents that screenshot to disk and attach the file; configs saved with a `path` template key that now fail on load/format.","solutions":["Convert the local file to a base64 data URL and pass it as `url`: `f'data:image/png;base64,{base64.b64encode(open(p,\"rb\").read()).decode()}'`.","Host the image (or use a signed URL / object-storage URL) and pass that as `url`.","Remove the `path` key from the template entirely so it cannot render truthy."],"exampleFix":"# before\nprompt.format(path='/tmp/cat.png')  # ValueError\n\n# after\nimport base64\nfrom pathlib import Path\np = Path('/tmp/cat.png')\ndata_url = 'data:image/png;base64,' + base64.b64encode(p.read_bytes()).decode()\nprompt.format(url=data_url)","handlingStrategy":"validation","validationCode":"def to_image_url(source: str) -> str:\n    if source.startswith('path:') or (not source.startswith(('http://', 'https://', 'data:'))):\n        import base64, pathlib\n        p = pathlib.Path(source)\n        return 'data:image/png;base64,' + base64.b64encode(p.read_bytes()).decode()\n    return source\n\n# usage: prompt.format(url=to_image_url('/tmp/img.png'))","typeGuard":"def is_safe_image_reference(value: str) -> bool:\n    return isinstance(value, str) and value.startswith(('http://', 'https://', 'data:'))","tryCatchPattern":"try:\n    out = prompt.format(**vars_)\nexcept ValueError as e:\n    if \"'path'\" in str(e):\n        out = prompt.format(url=to_image_url(vars_['path']))\n    else:\n        raise","preventionTips":["Never pass local file paths to image prompts on langchain-core >= 0.3.15; pre-encode to base64 data URLs.","Grep configs and templates for a 'path' key before upgrading langchain-core.","Keep image sources behind a single helper that normalizes everything to url form."],"tags":["prompts","image","security","version-change","multimodal"],"backgroundTag":null,"analyzedSha":"e32fa9a52eab3b61ad7a45399bfde59b3e580fc4","analyzedAt":"2026-08-14T18:42:09.092Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}