EUVD-2026-38332Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
LangChain apps typically accept malicious prompts over a network; AC:H for required filesystem knowledge and specific component deployment; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 pypi packages depend on langchain (3 direct, 0 indirect)
- 1 pypi packages depend on langchain-anthropic (0 direct, 1 indirect)
Ecosystem-wide dependent count for version 1.3.9 and other introduced versions.
DescriptionNVD
LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source - including an LLM acting on untrusted input - the result can be disclosure of files outside the intended boundary. This vulnerability is fixed in 1.3.9.
AnalysisAI
Path traversal and sandbox escape in LangChain prior to 1.3.9 allow untrusted inputs - including LLM-generated content steered by adversarial prompts - to escape a configured filesystem root boundary. Three components are affected: a file-search agent middleware that validates a starting directory but not glob patterns or symlink targets; prompt and chain/agent configuration loaders that resolve path fields without root confinement; and path-prefix authorization logic that performs string-prefix comparison without segment boundaries, allowing sibling paths to bypass access controls. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses at least one of three affected LangChain components: (1) `FilesystemFileSearchMiddleware` configured with a root directory and receiving user-controlled or LLM-generated glob patterns or base path values - the middleware validated the starting directory parameter but not the pattern or symlink targets of matched files; (2) prompt or chain/agent configuration loaders that accept a path field from untrusted or shared sources and resolve it without confining the result to a trusted base directory; or (3) path-prefix authorization logic reachable with attacker-influenced path strings, where a sibling path sharing the same string prefix can be accepted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 5.1 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker interacting with a public-facing LangChain-based assistant submits a prompt instructing the embedded LLM to search for files matching the pattern `../../etc/passwd` or to load an agent configuration from a symlinked path pointing outside the sandbox root. The file-search middleware or configuration loader resolves the path without rejecting the `..` component or verifying the symlink target remains within the configured root, returning host file contents to the attacker. … |
| Remediation | Vendor-released patch: `langchain` 1.3.9 and `langchain-anthropic` 1.4.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in
A remote code execution vulnerability in langchain-ai/langchain (CVSS 10.0). Risk factors: public PoC available. Vendor
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through
A vulnerability in the GraphCypherQAChain class of langchain-ai/langchainjs versions 0.2.5 and all versions with this cl
A vulnerability was found in LangChain langchain_community 0.0.26. Rated critical severity (CVSS 9.8), this vulnerabilit
An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. Rated
An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted
An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the fro
An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. Rated criti
An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Pyth
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today