LangChain is a Python framework for building LLM‑powered agents. The vulnerability arises from components that resolve filesystem paths and glob patterns without properly restricting them to a defined root. When the framework processes a path field, a search pattern, or a workspace content supplied from an untrusted source—such as user input or text generated by an LLM—an attacker can supply a pattern that traverses directories, follows symlinks, or exploits a faulty prefix check, leading the loader or middleware to read files outside the intended sandbox. This leakage can reveal internal configuration files, secrets, or other sensitive data, compromising confidentiality. The weakness maps to CWE‑22 (Path Traversal) and CWE‑59 (Improper Restriction of Pathname Manipulation).

The affected products are LangChain and LangChain‑Anthropic libraries under the langchain‑ai purview. Any installation using a version earlier than 1.3.9 is potentially vulnerable. The flaw exists in components such as the file‑search agent middleware, prompt‑ and chain/agent‑configuration loaders, and path‑prefix authorization checks. Both packages receive external path inputs and could be triggered by user‑supplied arguments or LLM‑generated strings. No specific product edition or operating system is mentioned, so any environment running the vulnerable code is at risk—whether a local script, cloud function, or server‑side application.

The CVSS score of 5.1 indicates a medium impact, and the EPSS score is not available, making the current exploitation probability unknown. The issue is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet. The vulnerability can be exploited by embedding malicious path fragments in input that the framework later interprets without proper validation. Attackers who control the data channel feeding paths—such as an LLM endpoint that accepts user prompts—could trigger the path traversal and obtain filesystem data outside the intended sandbox.