{"id":"PYSEC-2026-2556","summary":"LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders","details":"## Summary\n\nSeveral LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the *resolved* path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. We have no evidence of this behavior being triggered in the wild.\n\n## Affected users / systems\n\nYou may be affected if you expose an agent with filesystem-search middleware over a directory and accept prompts or retrieved content influenced by untrusted sources; load prompt or chain/agent configuration from untrusted or shared sources; or rely on path-prefix restrictions to confine tool file access. Callers that confine these components to fully trusted inputs and first-party configuration are not affected.\n\n## Impact\n\n- Confidentiality: disclosure of file contents outside the intended root/sandbox.\n- Authorization: path-prefix bypass can grant access to sibling resources beyond the intended subtree.\n\n## Patches / mitigation\n\nThe affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root before reading or returning it; search patterns will be normalized so they cannot escape the root; configuration loaders will confine resolved path fields and reject symlink escapes unless the caller explicitly opts in to dangerous loading; and path-prefix checks will enforce a path-segment boundary. Path validation will be made operating-system-portable.\n\n## Compatibility\n\nCallers that already pass only in-root paths, validated configuration, and trusted search inputs see no behavioral change. Callers that intentionally reference external paths can opt in via the existing dangerous-loading flag.\n\n## Operational guidance\n\nConfine filesystem-backed agent tools to a dedicated directory and prefer running them sandboxed/containerized; validate path and identifier inputs where untrusted input enters; do not enable dangerous loading for configuration whose origin you do not control.\n\n## LangSmith / hosted deployments note\n\nThis issue concerns library components executed by agents.","aliases":["CVE-2026-55443","GHSA-gr75-jv2w-4656","PYSEC-2026-2192"],"modified":"2026-07-13T16:43:09.845932020Z","published":"2026-07-13T15:46:17.779960Z","references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchain/security/advisories/GHSA-gr75-jv2w-4656"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55443"},{"type":"WEB","url":"https://github.com/langchain-ai/langchain/commit/dcaf7795a3e6590af55c3ff7bda6add6355e9ea6"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchain"},{"type":"PACKAGE","url":"https://pypi.org/project/langchain-anthropic"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gr75-jv2w-4656"}],"affected":[{"package":{"name":"langchain-anthropic","ecosystem":"PyPI","purl":"pkg:pypi/langchain-anthropic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6"}]}],"versions":["0.0.1","0.0.1.post1","0.0.2","0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14rc1","0.1.14rc2","0.1.15","0.1.16","0.1.17","0.1.18","0.1.19","0.1.2","0.1.20","0.1.21","0.1.22","0.1.23","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.8rc1","0.1.9","0.2.0","0.2.0.dev0","0.2.0.dev1","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.10","0.3.11","0.3.12","0.3.13","0.3.14","0.3.15","0.3.16","0.3.17","0.3.18","0.3.19","0.3.2","0.3.20","0.3.21","0.3.22","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.7rc1","0.3.8","0.3.9","1.0.0","1.0.0a1","1.0.0a2","1.0.0a3","1.0.0a4","1.0.0a5","1.0.1","1.0.2","1.0.3","1.0.4","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/langchain-anthropic/PYSEC-2026-2556.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}