Advisoriesby IbisLangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
Summary
Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source , including an LLM acting on untrusted input , the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild.
Affected users / systems
You may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| langchain PyPI | < 1.3.9 | 1.3.9 |
Details and references
## Summary Several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source , including an LLM acting on untrusted input , the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. ## Affected users / systems You may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. ## Impact - Confidentiality: disclosure of file contents outside the intended root/sandbox. - Authorization: path-prefix bypass can grant access to sibling resources beyond the intended subtree. ## Patches / mitigation The affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. ## Compatibility Callers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. ## Operational guidance Confine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. ## LangSmith / hosted deployments note This issue concerns library components executed by agents.
More LangChain advisories
All LangChain
LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warningCVE-2026-45134fixed in 0.3.30LangChain: unsafe deserializationCVE-2026-44843fixed in 0.3.85 +1LangChain has incomplete f-string validation in prompt templatesCVE-2026-40087fixed in 0.3.84 +1LangChain Core has Path Traversal vulnerabilites in legacy `load_prompt` functionsCVE-2026-34070fixed in 1.2.22LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderCVE-2026-27795fixed in 1.1.18@langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validationCVE-2026-26019fixed in 1.1.14