Medium, CVSS 5.1PyPIAmendedPublished
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
CVE-2026-55443 · GHSA-gr75-jv2w-4656
- Affected
- PyPI langchain-anthropic <= 1.4.5
- Fixed in
- 1.4.6· Vendor fix available
- Issue
- Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being…
Recommended action: Upgrade to 1.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.