langchain-anthropic
The agent engineering platform.
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 104
- Cadence
- ~7 days
- Last 12 months
- 37
Reach
- Stars
- 148.6k
Details
- License
- MIT
- First release
- Dec 20, 2023
| Version | Released | |
|---|---|---|
1.7.7
patch
| ||
1.7.6
patch
| ||
1.7.5
patch
| ||
1.7.4
patch
| ||
1.7.3
patch
| ||
1.7.2
patch
| ||
1.7.1
patch
| ||
1.7.0
minor
| ||
1.6.1
patch
| ||
1.6.0
minor
| ||
1.5.6
patch
| ||
1.5.5
patch
| ||
1.5.4
patch
| ||
1.5.3
patch
| ||
1.5.2
patch
| ||
1.5.1
patch
| ||
1.5.0
minor
| ||
1.4.8
patch
| ||
1.4.7
patch
| ||
1.4.6
patch
| ||
1.4.5
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.4
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.3
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.2
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.1
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.4.0
minor
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.3.5
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.3.4
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.3.3
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.3.2
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.3.1
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.3.0
minor
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.1.0
minor
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.4
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.3
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.2
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.1
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.0
major
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.0a5
pre
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.0a4
pre
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
0.3.22
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.0a3
pre
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.0a2
pre
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
0.3.21
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
0.3.20
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
1.0.0a1
pre
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
0.3.19
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
0.3.18
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev | ||
0.3.17
patch
1 CVE
CVE-2026-55443
PYSEC-2026-2556
GHSA-gr75-jv2w-4656
PYSEC-2026-2192
Jul 13, 2026
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
5.1
/ 10
Medium
Local
High
None
None
Unchanged
High
None
None
SummarySeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild. Affected users / systemsYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected. Impact
Patches / mitigationThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable. CompatibilityCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag. Operational guidanceConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control. LangSmith / hosted deployments noteThis issue concerns library components executed by agents. Affected versions
0.0.1
0.0.1.post1
0.0.2
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14rc1
0.1.14rc2
0.1.15
+ 72 more Show less
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.23
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.8rc1
0.1.9
0.2.0
0.2.0.dev0
0.2.0.dev1
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.2
0.3.20
0.3.21
0.3.22
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.7rc1
0.3.8
0.3.9
1.0.0
1.0.0a1
1.0.0a2
1.0.0a3
1.0.0a4
1.0.0a5
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
Fixed in
1.4.6
References
Updated Jul 13, 2026 · Source: OSV.dev |