LangChain file-search agent middleware and config loaders allow path traversal beyond configured sandbox root

Undisclosed·LangChain (file-search agent middleware, prompt/chain/agent configuration loaders, path-prefix authorization checks)Fixed

LangChain's file-search agent middleware validated only the configured starting directory, not the search pattern or the resolved target of matched files, so glob patterns and symlinks could resolve to files outside the intended root; separately, prompt/chain/agent config loaders resolved path fields without confining them to a trusted base, and path-prefix authorization checks compared paths by string prefix without a path-segment boundary, letting a sibling path sharing the same prefix pass as authorized.

Blast radius

Disclosure of file contents outside the intended root/sandbox and authorization bypass granting access to sibling resources beyond the intended subtree, for any deployment exposing an agent with filesystem-search middleware, or loading prompt/chain/agent configuration, from untrusted or LLM-influenced input; GitHub/OSV state there is no evidence of exploitation in the wild.

Root cause

Path validation checked the starting directory and string prefixes rather than canonicalizing the final resolved path (following symlinks and glob expansion) and enforcing a path-segment boundary before granting file access.

How it was caught

Found and reported as a vulnerability (CWE-22 path traversal, CWE-59 symlink handling) and coordinated through a GitHub Security Advisory rather than discovered via an in-production breach.

What changed

LangChain patched affected components (langchain fixed in 1.3.9, langchain-anthropic fixed in 1.4.6) to canonicalize candidate paths and resolve symlinks, verify the resolved real path stays within the configured root, normalize search patterns so they cannot escape the root, confine configuration-loader path fields and reject symlink escapes unless a caller explicitly opts into dangerous loading, and enforce path-segment boundaries in prefix checks.

Take-awayWhen granting an LLM agent filesystem-search or config-loading tools, canonicalize and re-check the fully resolved path (post-symlink, post-glob) against the sandbox root on every access — validating only the starting directory or using string-prefix matching is not sufficient confinement.