vulnerability ·

LangChain file-search agents can read beyond their configured directory

Untrusted paths, search patterns or symlinks can bypass directory boundaries in LangChain agent middleware and configuration loaders, exposing files outside the intended root.

medium severityconfirmed confidencepatchedNo known exploitation

Quick answer

What defenders need to know

What is it?: Untrusted paths, search patterns or symlinks can bypass directory boundaries in LangChain agent middleware and configuration loaders, exposing files outside the intended root.
Who is affected?: langchain, langchain-anthropic langchain <= 1.3.8, langchain-anthropic <= 1.4.5
What should defenders do?: Upgrade langchain to 1.3.9 and langchain-anthropic to 1.4.6 where installed, or later supported patched releases.
Is a fix available?: Yes. Upgrade to langchain 1.3.9, langchain-anthropic 1.4.6.

01 / Response

What to do

Upgrade langchain to 1.3.9 and langchain-anthropic to 1.4.6 where installed, or later supported patched releases.
Confine file tools to an isolated directory and do not allow dangerous loading of untrusted configuration.

02 / Technical assessment

Evidence-backed analysis

Affected components do not consistently validate resolved paths. The maintainer reports no evidence of in-the-wild triggering; fully trusted inputs are outside the described exposure.

Official advisory identifies filesystem boundary failures in agent-executed components.
No RAG architecture is inferred from the presence of file-search functionality.

How to interpret evidence and confidence

03 / Timeline