---
id: CVE-2026-55443
aliases:
  - GHSA-gr75-jv2w-4656
  - PYSEC-2026-2192
  - PYSEC-2026-2556
title: >-
  LangChain: Path traversal and sandbox escape in LangChain file-search
  middleware and loaders
summary: >-
  LangChain: Path traversal and sandbox escape in LangChain file-search
  middleware and loaders
severity: medium
cvss: 5.1
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: langchain
product: langchain
ecosystem: pip
affected:
  - langchain < 1.3.9
  - langchain-anthropic < 1.4.6
patched:
  - langchain 1.3.9
  - langchain-anthropic 1.4.6
published: '2026-06-16'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:51:08.737829576Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gr75-jv2w-4656'
references:
  - url: >-
      https://github.com/langchain-ai/langchain/security/advisories/GHSA-gr75-jv2w-4656
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55443'
  - url: >-
      https://github.com/langchain-ai/langchain/commit/dcaf7795a3e6590af55c3ff7bda6add6355e9ea6
  - url: 'https://github.com/langchain-ai/langchain'
tags:
  - osv
  - pip
epss: 0.0021
epssPercentile: 0.11538
ingestedAt: '2026-07-08T18:25:49.770Z'
---

## Overview

## Summary

Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild.

## Affected users / systems

You may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected.

## Impact

- Confidentiality: disclosure of file contents outside the intended root/sandbox.
- Authorization: path-prefix bypass can grant access to sibling resources beyond the intended subtree.

## Patches / mitigation

The affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable.

## Compatibility

Callers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag.

## Operational guidance

Confine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control.

## LangSmith / hosted deployments note

This issue concerns library components executed by agents.

## Affected packages

- `langchain < 1.3.9`
- `langchain-anthropic < 1.4.6`

## Remediation

Upgrade to a patched release:

- `langchain 1.3.9`
- `langchain-anthropic 1.4.6`