Executive brief
LangChain is a popular framework used to build applications powered by large language models (LLMs). A vulnerability in its file-handling components could allow an attacker to trick the system into accessing files outside of its intended directory. This could lead to the exposure of sensitive system files or configuration data, especially if the application processes untrusted input from users or the LLM itself.
Technical details
The vulnerability stems from improper path validation and canonicalization in LangChain's file-search middleware, prompt loaders, and configuration loaders. Specifically, these components resolve filesystem paths or expand search patterns without ensuring the final resolved path remains within the intended root directory. Attackers can use glob patterns or symlinks to bypass directory restrictions. Additionally, path-prefix authorization checks were found to use simple string prefix matching without enforcing path-segment boundaries, allowing access to sibling directories. This can be exploited if an LLM or untrusted source influences path values. Patches in LangChain 1.3.9 and langchain-anthropic 1.4.6 introduce mandatory path canonicalization and segment-aware prefix checks.
Affected products
- LangChain AI langchain <= 1.3.8
- LangChain AI langchain-anthropic <= 1.4.5
Timeline
- 2026-06-12: disclosed
- 2026-06-16: advisory