Executive brief
LangChain is a popular framework used to build applications powered by Artificial Intelligence and Large Language Models (LLMs). A security flaw in how the framework handles file paths allows an attacker—potentially by tricking an AI agent with malicious input—to access sensitive files on the underlying server that should be off-limits. This could lead to the unauthorized disclosure of private data or system configuration files, though it requires specific conditions to exploit.
Technical details
Multiple components in LangChain, including file-search middleware and configuration loaders, fail to consistently canonicalize and validate filesystem paths against a trusted root directory. The vulnerability stems from improper handling of glob patterns, symlinks, and string-prefix authorization checks that lack path-segment boundaries (CWE-22, CWE-59). An attacker can exploit this by providing untrusted input to an LLM or agent that influences path resolution, leading to arbitrary file read outside the intended sandbox. The issue is mitigated in LangChain 1.3.9 and LangChain-Anthropic 1.4.6 by enforcing path normalization and strict containment checks.
Affected products
- langchain-ai langchain < 1.3.9
- langchain-ai langchain-anthropic < 1.4.6
Timeline
- 2026-06-12: patched: Fix committed to repository
- 2026-06-22: disclosed: Security advisory published