CVE-2026-55443

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.3.9

Description Several components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. This occurs in a file-search agent middleware that validates a starting directory but fails to validate the search pattern or the resolved target of matched files, allowing glob patterns and symlinks to access files outside the configured root. Additionally, prompt and chain/agent-configuration loaders resolve path fields without confining them to a trusted base or rejecting symlink targets. Furthermore, path-prefix authorization checks use string prefix comparison without a path-segment boundary, which allows sibling paths sharing the same prefix to be accepted. If these components process path values, search patterns, or workspace contents influenced by an untrusted source, such as an LLM acting on untrusted input, it can lead to the disclosure of files outside the intended boundary.

Recommendations Update to version 1.3.9.