CVE-2026-55443: LangChain Path-Traversal File Access Vulnerability

Technical summary

The vulnerability stems from multiple path-handling failures across LangChain components: (1) file-search agent middleware validates the starting directory but does not constrain glob patterns or resolve symlink targets, allowing directory traversal; (2) prompt and chain/agent configuration loaders resolve path fields without enforcing a trusted base directory or rejecting symlinks; and (3) path-prefix authorization checks use string comparison without enforcing path-segment boundaries, permitting sibling directories with matching prefixes to bypass controls. The common thread is insufficient normalization and boundary validation. When an LLM, user, or external service provides path input, these flaws enable reads outside the intended root.

Business impact

Applications built with vulnerable LangChain versions risk exposure of sensitive files—configuration files, API keys, private data, or other secrets—if the LLM or user input is not independently validated. The severity depends on what files exist in accessible directories and what an LLM agent is permitted to do. For systems using LangChain agents to manage file operations in multi-tenant or untrusted-input scenarios, this is a meaningful data-loss risk. Lateral compromise or privilege escalation may follow if exposed credentials are present.

Affected systems

LangChain versions prior to 1.3.9 are affected. Any application or service using LangChain agents or configuration loaders that handle file paths is potentially impacted, particularly those that expose file-search or config-loading functionality to untrusted input or LLM-driven decisions.

Exploitability

Exploitation requires the ability to influence file paths or search patterns passed to LangChain components—either directly through user input, indirectly through an LLM agent acting on untrusted prompts, or via crafted workspace configuration. The CVSS score of 5.1 (MEDIUM) reflects that local access is typically required and exploitation depends on the application architecture, but the attack is practical and does not require special privileges or user interaction.

Remediation

Upgrade to LangChain 1.3.9 or later, which implements proper path normalization and confinement. Review your application's use of LangChain file-handling and agent components, especially where external or LLM-driven input influences file operations. Consider applying defense-in-depth: run agents with least-privilege filesystem access, validate and sanitize user input before passing it to LangChain, and use OS-level access controls to limit the blast radius.

Patch guidance

Update LangChain to version 1.3.9 or later. Verify the update through your package manager (pip, npm, or equivalent) and test file-handling components in a staging environment before production deployment. If you are using LangChain in a containerized or sandboxed environment, verify that the new version is pulled and deployed consistently across all instances.

Detection guidance

Monitor application logs for unusual file-access patterns, particularly searches or loads that attempt to access paths outside expected directories. If you have observability into LangChain agent execution, watch for glob patterns or symlink references in file-operation inputs. Filesystem-level monitoring can flag attempts to resolve paths beyond configured boundaries. Code review of LangChain usage should identify components that handle path inputs and assess whether those inputs are validated before reaching LangChain.

Why prioritize this

While the CVSS score is MEDIUM, the practical risk is elevated for any application that uses LangChain agents with untrusted input or LLM-driven automation. The vulnerability is not in the CISA KEV catalog, but it is straightforward to fix (a version upgrade), making it an efficient candidate for near-term patching. Prioritize based on whether your use of LangChain involves file operations and untrusted input.

Risk score, explained

The CVSS 3.1 score of 5.1 reflects: (1) local attack vector, limiting immediate exposure; (2) high complexity required (the application must use vulnerable components in a way that accepts untrusted input); but (3) high confidentiality impact once achieved. The score does not fully capture risk in scenarios where LLM agents are widely used to automate file operations, making it important to assess your specific application context beyond the base score.

Frequently asked questions