GHSA-gr75-jv2w-4656: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders
- Identifier
- GHSA-gr75-jv2w-4656
- Published
- Record updated
- Affected
- langchain-anthropic <= 1.4.5, fixed in 1.4.6, released June 12, 2026, 4 days before disclosure
- langchain <= 1.3.8, fixed in 1.3.9, released June 12, 2026, 4 days before disclosure
Summary
Several LangChain components resolve filesystem paths or expand search patterns without confining the resolved path to the intended root directory. Affected behaviors include a file-search agent middleware that does not check glob patterns or symlink targets, configuration loaders that accept unconfined path fields, and path-prefix checks that lack a path-segment boundary. When these receive path values or search patterns influenced by untrusted input, including an LLM acting on untrusted input, files outside the intended boundary can be disclosed.
Mitigation
The affected components will canonicalize candidate paths (resolving symlinks) and verify the resolved real path remains within the configured root, normalize search patterns so they cannot escape the root, confine resolved path fields in configuration loaders and reject symlink escapes unless the caller explicitly opts in to dangerous loading, and enforce a path-segment boundary in path-prefix checks. Specific fixed version numbers are not stated in the source.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- langchainPyPILLM dependency since 2022-10-25 · 31 tracked dependents
- langchain-anthropicPyPILLM dependency since 2023-12-20 · 13 tracked dependents
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database