CVE-2026-55443: LangChain path confinement flaws expose files outside intended root

Summary

LangChain versions prior to 1.3.9 contain several components that resolve filesystem paths or expand search patterns without confining results to the intended root directory. The file-search agent middleware validates only the starting directory, so glob patterns and symlinks can reach files outside the configured root, and prompt and agent configuration loaders accept path fields without confinement or symlink rejection. When these components receive path values or search patterns influenced by an untrusted source, including an LLM acting on untrusted input, they can disclose files outside the intended boundary.

Mitigation

Fixed in 1.3.9.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langchainPyPILLM dependency since 2022-10-25 · 31 tracked dependents
• langchain-anthropicPyPILLM dependency since 2023-12-20 · 13 tracked dependents

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database