Executive brief
Langroid is a software framework used to build applications powered by Large Language Models (LLMs). A security flaw in its file-handling tools allows an AI agent or a user to bypass directory restrictions and access files they shouldn't be able to see or modify. This could lead to the theft of sensitive local secrets, configuration files, or the unauthorized modification of system data if the application is configured to allow the AI to read or write files.
Technical details
A path traversal vulnerability exists in Langroid's `ReadFileTool` and `WriteFileTool` components prior to version 0.64.0. While these tools attempt to restrict operations to a specific directory (`curr_dir`) by changing the process working directory, they fail to resolve and validate the user-supplied `file_path`. An attacker or a malicious LLM agent can provide relative path sequences (e.g., `../etc/passwd`) to escape the intended sandbox. This allows for unauthorized reading of sensitive files or writing of arbitrary files on the local filesystem where the agent is running. The issue is addressed in version 0.64.0 by implementing path resolution and boundary enforcement.
Affected products
- langroid langroid < 0.64.0
Timeline
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: NVD publication date
- 2026-06-01: patched: Version 0.64.0 released to address the issue