LangChain CVE-2026-55443

Exploitation requires that the target application uses at least one of three affected LangChain components: (1) FilesystemFileSearchMiddleware configured with a root directory and receiving user-controlled or LLM-generated glob patterns or base path values - the middleware validated the starting directory parameter but not the pattern or symlink targets of matched files; (2) prompt or chain/agent configuration loaders that accept a path field from untrusted or shared sources and resolve it without confining the result to a trusted base directory; or (3) path-prefix authorization logic reachable with attacker-influenced path strings, where a sibling path sharing the same string prefix can be accepted. In all cases, the attacker must control or influence the input channel that reaches the vulnerable component - this can be direct API/UI input or indirect LLM prompt injection via untrusted retrieved content. Exploitation is further limited by the need to know or enumerate the target host's filesystem layout, the requirement that the application is deployed with filesystem-backed LangChain components (not universal across LangChain deployments), and the application accepting untrusted input to the relevant code paths. Callers that pass only internally-generated, validated inputs to these components are not affected.

The NVD-assigned vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 5.1 (Medium). The AV:L assignment warrants scrutiny: LangChain is predominantly deployed as a network-accessible API or web service, and the attack input - crafted glob patterns, symlinked paths, or malicious configuration fields - can be submitted over the network by an unauthenticated user or injected indirectly via LLM prompt injection on untrusted retrieved content. An AV:N assignment is more consistent with the realistic attack surface and would yield a score closer to 5.9. AC:H is defensible because exploitation requires specific deployment conditions: the attacker must reach one of the three vulnerable components, must know or guess the target filesystem layout, and the application must be configured with filesystem-backed agent middleware or untrusted configuration loading. The GHSA advisory explicitly states no evidence of in-the-wild triggering, and the CVE is not in CISA KEV. No EPSS score was provided in the input data; exploitation probability must be inferred contextually. Real-world priority should be elevated for any deployment where user-controlled prompts or externally retrieved content can reach LangChain's file-search middleware or configuration loaders, as the confidentiality impact (C:H) is severe - arbitrary file read on the host.

An attacker interacting with a public-facing LangChain-based assistant submits a prompt instructing the embedded LLM to search for files matching the pattern ../../etc/passwd or to load an agent configuration from a symlinked path pointing outside the sandbox root. The file-search middleware or configuration loader resolves the path without rejecting the .. component or verifying the symlink target remains within the configured root, returning host file contents to the attacker. No public exploit code has been identified at time of analysis.