LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and chain/agent-configuration loaders that accept path fields and resolve them without confining the result to a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these components receive path values, search patterns, or workspace contents influenced by an untrusted source — including an LLM acting on untrusted input — the result can be disclosure of files outside the intended boundary. This vulnerability is fixed in 1.3.9.

The version of LangChain installed on the remote host is prior to 1.3.9. It is, therefore, affected by a path traversal vulnerability:

  - Several LangChain components that resolve filesystem paths or expand search patterns do not     consistently confine the resolved path to the intended root directory. Affected behaviors     include a file-search agent middleware that validates a starting directory but not the search     pattern or resolved target of matched files, prompt and chain/agent-configuration loaders that     accept path fields and resolve them without confining the result to a trusted base, and     path-prefix authorization checks that compare by string prefix without a path-segment boundary.
    When these components receive path values influenced by an untrusted source, the result can be     disclosure of files outside the intended boundary. (CVE-2026-55443)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several
    LangChain components that resolve filesystem paths or expand search patterns do not consistently confine
    the resolved path to the intended root directory. Affected behaviors include: a file-search agent
    middleware that validates a starting directory but not the search pattern or the resolved target of
    matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- and
    chain/agent-configuration loaders that accept path fields and resolve them without confining the result to
    a trusted base or rejecting symlink targets; and path-prefix authorization checks that compare by string
    prefix without a path-segment boundary, so a sibling path sharing the prefix is accepted. When these
    components receive path values, search patterns, or workspace contents influenced by an untrusted source —
    including an LLM acting on untrusted input — the result can be disclosure of files outside the intended
    boundary. This vulnerability is fixed in 1.3.9. (CVE-2026-55443)

ID	Name	Product	Family	Severity
322754	LangChain < 1.3.9 Path Traversal (CVE-2026-55443)	Nessus	Artificial Intelligence	medium
443300	SCA: security update for langchain, langchain-anthropic (GHSA-gr75-jv2w-4656)	Tenable Cloud Security	SCA Checks	medium
443300	SCA: security update for langchain, langchain-anthropic (GHSA-gr75-jv2w-4656)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-55443

medium

Tenable Plugins

medium

medium

medium