{
 "id": "AIR-2026-0748",
 "slug": "cve-2026-55443-langchain-path-traversal-and-sandbox-escape-i",
 "title": "CVE-2026-55443: LangChain: Path traversal and sandbox escape in file loaders",
 "summary": "Several LangChain components that resolve filesystem paths fail to consistently confine resolved paths to intended root directories. This allows glob patterns and symlinks to access unauthorized files outside the configured root.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "LangChain"
 ],
 "incident_date": "2026-06-16",
 "incident_date_precision": "day",
 "first_reported": "2026-06-16",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-gr75-jv2w-4656",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-55443: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders",
   "published_at": "2026-06-16"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55443",
   "publisher": "NVD",
   "title": "CVE-2026-55443: LangChain is a framework for building agents and LLM-powered applications.",
   "published_at": "2026-06-22"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-55443",
  "langchain",
  "path-traversal",
  "infra_vuln"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}