What is the CVSS score of CVE-2026-55443?

CVE-2026-55443 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-55443?

Yes, a patch is available for CVE-2026-55443. Update the affected software to the latest version immediately.

LangChain CVE-2026-55443

EUVD-2026-38332 MEDIUM

Path Traversal (CWE-22)

2026-06-22 GitHub_M

Path Traversal Langchain Langchain Ai Langchain Anthropic

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

LangChain apps typically accept malicious prompts over a network; AC:H for required filesystem knowledge and specific component deployment; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 26, 2026 - 20:07 NVD

5.1 (MEDIUM) 5.5 (MEDIUM)

Patch available

Jun 22, 2026 - 20:01 EUVD

Source Code Evidence Fetched

Jun 22, 2026 - 19:02 vuln.today

Analysis Generated

Jun 22, 2026 - 19:02 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 pypi packages depend on langchain (4 direct, 0 indirect)
1 pypi packages depend on langchain-anthropic (0 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.3.9 and other introduced versions.

DescriptionNVD

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source - including an LLM acting on untrusted input - the result can be disclosure of files outside the intended boundary. This vulnerability is fixed in 1.3.9.

AnalysisAI

Path traversal and sandbox escape in LangChain prior to 1.3.9 allow untrusted inputs - including LLM-generated content steered by adversarial prompts - to escape a configured filesystem root boundary. Three components are affected: a file-search agent middleware that validates a starting directory but not glob patterns or symlink targets; prompt and chain/agent configuration loaders that resolve path fields without root confinement; and path-prefix authorization logic that performs string-prefix comparison without segment boundaries, allowing sibling paths to bypass access controls. No public exploit code has been identified at time of analysis and this CVE does not appear in CISA KEV, but the risk is meaningful for any deployment that exposes LangChain filesystem agents to untrusted user input or LLM prompt injection.

Technical ContextAI

LangChain (pip packages langchain and langchain-anthropic) is a Python framework for orchestrating LLM-based agents, chains, and tool-calling workflows. The vulnerability is a CWE-22 (Path Traversal) class defect with three distinct manifestations in the same codebase. First, FilesystemFileSearchMiddleware.glob_search validated the starting directory but forwarded the glob pattern to Path.glob without rejecting .. components or absolute paths, and enumerated matching files via rglob with followlinks=True (Python's default), allowing in-root symlinks pointing outside the root to be followed. Second, configuration loaders resolved path fields from untrusted YAML/JSON without calling Path.resolve() and comparing against a trusted base. Third, path-prefix authorization compared paths by string prefix rather than by normalized segment boundary, so /data/foo authorization could be bypassed by the path /data/foobar. The fix in commit dcaf7795 introduces _is_within_root() using Path.resolve().is_relative_to(), switches directory walking to os.walk(followlinks=False), rejects glob patterns starting with / or containing .. components, and applies containment checks post-symlink-resolution. Affected CPEs are cpe:2.3:a:langchain-ai:langchain:*:*:*:*:*:*:*:* and cpe:2.3:a:langchain-ai:langchain-anthropic:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: langchain 1.3.9 and langchain-anthropic 1.4.6. Upgrade both packages immediately via pip install --upgrade langchain1.3.9 langchain-anthropic1.4.6. The fix is confirmed in commit dcaf7795a3e6590af55c3ff7bda6add6355e9ea6 and detailed in GHSA-gr75-jv2w-4656 (https://github.com/langchain-ai/langchain/security/advisories/GHSA-gr75-jv2w-4656). If patching is not immediately feasible, restrict filesystem-backed agent components to fully trusted, internally-generated inputs by removing any code paths that allow user-supplied prompts or LLM-generated content to influence path values, glob patterns, or configuration source paths. Disable the dangerous-loading opt-in flag in configuration loaders if it is enabled in production, as this flag bypasses symlink protections. Audit all deployments where FilesystemFileSearchMiddleware is used with a user-facing input channel, as these represent the highest-risk configuration. Applications that pass only first-party, trusted inputs to these components require no immediate action but should still be upgraded.