Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

CVE-2026-55443: path traversal and sandbox escape in LangChain's file-search middleware and loaders

AIR-2026-0137 AIR record · 2026-06-langchain-file-search-path-traversal
Open in dashboard About
From the supporting source
LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersgithub.com
The record
Disclosed
2026-06-12
Vendor
LangChain Inc.
Product
langchain, langchain-anthropic
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the agent-supplied glob escaped the sandbox and read arbitrary files
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Agent supplied glob pattern or symlink
Impact type
Arbitrary file read, Sandbox escape
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI03 – Identity and Privilege Abuse
MITRE ATLAS
AML.T0055 – Unsecured Credentials
NIST AI RMF
GOVERN 6.1
EU AI Act
Article 13
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool misuse
Mitigation
Apply least-privilege principle; Regular policy audits.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
langchain <= 1.3.8 and langchain-anthropic <= 1.4.5 using the file-search middleware
Capability abused
file_searchfile_readglob_expansion
Defense & remediation
Recorded defense
starting-directory validation, but not on glob patterns or symlink targets, and prefix checks without segment boundaries
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
langchain 1.3.9, langchain-anthropic 1.4.6
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI03 Identity and Privilege AbuseCVE-2026-55443path_traversalsymlink_attackglob_bypassscope_violationfile_tool
Curator notes
GHSA-gr75-jv2w-4656, CVSS 5.1 Moderate. Same defect family as Anthropic's Filesystem MCP EscapeRoute (prefix matching without a path-segment boundary, plus unfollowed symlink checks) - included as evidence that this bug class recurs across agent file tools rather than for its severity.
Supporting sources
Cite as
Enkrypt AI. "CVE-2026-55443: path traversal and sandbox escape in LangChain's file-search middleware and loaders". AIR, AIR-2026-0137. https://agentincident.vercel.app/i/AIR-2026-0137/ (accessed 2026-10-19).