CVE-2026-55443: 
Python vulnerability analysis and mitigation

CVE-2026-55443 is a path traversal and sandbox escape vulnerability in LangChain's file-search middleware and configuration loaders that allows disclosure of files outside the intended root directory. It affects langchain versions ≤ 1.3.8 and langchain-anthropic versions ≤ 1.4.5. The vulnerability was published on June 22, 2026, and patched in langchain 1.3.9 and langchain-anthropic 1.4.6. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, and 5.1 (Moderate) per the GitHub Security Advisory (GitHub Advisory, Feedly).

The vulnerability is classified under CWE-22 (Path Traversal) and CWE-59 (Improper Link Resolution / Link Following). Three distinct weaknesses are present: (1) the FilesystemFileSearchMiddleware validates the starting directory but not the glob search pattern or the resolved target of matched files, allowing .. sequences and symlinks to escape the configured root; (2) prompt and chain/agent configuration loaders accept path fields and resolve them without confining results to a trusted base or rejecting out-of-root symlink targets; and (3) path-prefix authorization checks use a raw string prefix comparison (e.g., normalized.startswith(prefix)) without enforcing a path-segment boundary, so a sibling directory sharing the textual prefix (e.g., /memories2/ when /memories is allowed) is incorrectly accepted. Because LLM agents can be influenced by untrusted input to supply crafted path values or search patterns, the attack surface extends to prompt-injection scenarios where the LLM itself acts as the untrusted source (GitHub Advisory, GitHub Commit).

Successful exploitation results in unauthorized disclosure of file contents outside the intended sandbox or root directory (confidentiality impact: High; integrity and availability impact: None). An attacker or a compromised LLM acting on untrusted input can read arbitrary files accessible to the process running LangChain, potentially exposing secrets, credentials, configuration files, or other sensitive data stored on the host. Path-prefix bypass additionally allows access to sibling directory trees beyond the intended subtree, broadening the scope of unauthorized file access (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory, Feedly). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. The EPSS score is approximately 0.17%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires either local access with low privileges (per NVD scoring) or the ability to influence path/pattern inputs to LangChain components, which may be achievable via prompt injection in agentic deployments.

1. Identify a vulnerable deployment: Locate a LangChain-based agent (version ≤ 1.3.8) that exposes FilesystemFileSearchMiddleware or loads prompts/chain configurations from paths influenced by user or LLM input.
2. Craft a malicious glob pattern (path traversal): Supply a glob pattern containing .. segments (e.g., ../passwd or ../../etc/shadow) as the pattern argument to glob_search. The middleware validates the base directory but not the pattern, so Path.glob() resolves the pattern against the base and yields files outside the root.
3. Exploit symlink following: Alternatively, place or reference a symlink inside the configured root directory that points to a target outside the root (e.g., /root/link.txt -> /etc/passwd). The pre-patch code calls match.is_file() without resolving symlinks, so the symlinked file is enumerated and its contents returned.
4. Exploit path-prefix bypass: If allowed_prefixes is configured (e.g., /memories), supply a path to a sibling directory (e.g., /memories2/secret.txt). The pre-patch string prefix check (normalized.startswith('/memories')) incorrectly accepts this path, granting unauthorized access.
5. Via prompt injection: In an agentic context, inject a crafted instruction into untrusted content processed by the LLM (e.g., in a retrieved document) directing the agent to call glob_search with a traversal pattern, causing the agent to exfiltrate out-of-root file contents in its response. (GitHub Advisory, GitHub Commit)

• Logs: LangChain agent logs showing glob_search or grep_search calls with patterns containing .., absolute paths (starting with /), or ~; configuration loader calls referencing paths outside the expected workspace directory.
• File System: Presence of symlinks inside the LangChain root/workspace directory pointing to files or directories outside the root (e.g., ln -s /etc/passwd /workspace/link.txt).
• Process Behavior: Unexpected file read operations by the LangChain process on sensitive system files (e.g., /etc/passwd, /etc/shadow, credential files) observable via auditd or strace; agent responses containing content from files outside the configured workspace.
• Network: In agentic deployments, outbound data exfiltration following agent tool calls that reference out-of-root paths; LLM API requests containing file contents from unexpected system paths in the prompt or response payload.

Upgrade langchain to version 1.3.9 or later and langchain-anthropic to version 1.4.6 or later, which introduce _is_within_root() containment checks (resolving symlinks via Path.resolve() before comparison), rejection of glob patterns containing .. or absolute paths, os.walk(..., followlinks=False) to prevent symlink directory traversal, and segment-boundary-aware prefix checks (GitHub Advisory, GitHub Commit). As interim workarounds: confine filesystem-backed agent tools to a dedicated, isolated directory; run LangChain agents in sandboxed or containerized environments with minimal filesystem access; validate and sanitize all path and pattern inputs before passing them to LangChain components; and avoid enabling dangerous loading for configuration from untrusted sources.

The vulnerability was reported by security researchers credited as "Mistz1" and "deprrous" in the GitHub Security Advisory. The LangChain maintainer (nick-hollon-lc) published the advisory and patch on June 12–26, 2026, noting no evidence of in-the-wild exploitation. No significant broader media coverage or notable community commentary beyond the advisory and standard vulnerability database aggregation has been identified (GitHub Advisory).