CVE-2026-50181: Langroid Path Traversal Vulnerability

CVE-2026-50181 Overview

Langroid is a Python framework for building applications powered by large language models (LLMs). Versions prior to 0.64.0 contain a path traversal vulnerability [CWE-22] in the ReadFileTool and WriteFileTool components. The tools change the process working directory to curr_dir but fail to resolve and enforce that the final target path stays within that directory. A tool caller can supply sequences such as ../secret.txt to read or write files outside the configured workspace. Applications that expose Langroid file tools to an LLM agent or user-controlled tool call are affected. Version 0.64.0 patches the issue.

Critical Impact
An LLM agent or user-controlled tool caller can read arbitrary files and overwrite files outside the intended workspace directory, compromising confidentiality and integrity.

Affected Products

Langroid framework versions prior to 0.64.0
Applications exposing ReadFileTool to LLM agents or delegated coding agents
Applications exposing WriteFileTool to LLM agents or delegated documentation agents

Discovery Timeline

2026-07-10 - CVE-2026-50181 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-50181

Vulnerability Analysis

The vulnerability resides in langroid/agent/tools/file_tools.py. Both ReadFileTool and WriteFileTool treat curr_dir as the intended boundary for file operations. The implementation only calls os.chdir(curr_dir) before performing file I/O on the user-supplied file_path. No canonicalization step verifies that the resolved target remains within curr_dir.

Because relative paths containing .. segments resolve against the current working directory, an attacker-controlled file_path escapes the intended workspace. Absolute paths and symbolic links pointing outside curr_dir are equally unrestricted. The tool then invokes standard file operations such as read_file and create_file against the escaped path.

Root Cause

The root cause is missing path canonicalization and containment enforcement before performing file I/O. Setting the process working directory does not restrict where relative or absolute paths ultimately resolve. The tools trust caller-supplied paths without validating that the resolved absolute path is a descendant of curr_dir.

Attack Vector

Exploitation requires an attacker capable of issuing tool calls to a Langroid agent that exposes ReadFileTool or WriteFileTool. This includes prompt-injected LLM agents, delegated coding/documentation sub-agents, and any user-controlled tool invocation channel. Supplying a file_path such as ../secret.txt or ../../etc/passwd triggers the traversal. Write operations enable overwriting arbitrary files that the host process can access, including source code and configuration files.

python

# Security patch adding safe_resolve_path in langroid/utils/system.py
def safe_resolve_path(base_dir: str | Path, user_path: str | Path) -> Path:
    """
    Resolve ``user_path`` relative to ``base_dir`` and ensure the result stays
    within ``base_dir`` (a path-traversal guard for file tools).

    A ``user_path`` containing ``..`` segments, an absolute path, or a symlink
    pointing outside ``base_dir`` is rejected. Symlinks are resolved via
    :meth:`pathlib.Path.resolve`, so symlink-based escapes are caught as well.
    """
    base = Path(base_dir).resolve()
    target = (base / Path(user_path)).resolve()
    if target != base and base not in target.parents:
        raise ValueError(
            f"Path '{user_path}' is outside the allowed directory '{base}'"
        )
    return target

Source: GitHub Commit 56e2756. The patch introduces safe_resolve_path, which resolves both base_dir and the composed target with Path.resolve() and rejects any target that is not equal to or a descendant of base_dir.

Detection Methods for CVE-2026-50181

Indicators of Compromise

Tool call arguments containing .., absolute paths, or symlink targets in file_path parameters of ReadFileTool or WriteFileTool.
File access or modification events for paths outside the configured Langroid workspace by the Python process hosting the agent.
Unexpected new or modified files at paths above the project directory, such as parent directories or system paths.

Detection Strategies

Log every ReadFileTool and WriteFileTool invocation with the raw file_path argument and the resolved absolute path, then alert on any mismatch outside curr_dir.
Instrument the agent runtime to reject tool arguments where the resolved path escapes the intended workspace using logic equivalent to safe_resolve_path.
Correlate LLM prompt content with tool-call parameters to identify prompt-injection attempts that reference traversal sequences.

Monitoring Recommendations

Monitor filesystem telemetry for reads of sensitive files (.env, SSH keys, /etc/passwd) originating from the Python process running Langroid.
Track write events landing outside the designated workspace directory tree.
Retain agent conversation and tool-call transcripts for forensic review of suspected prompt injection.

How to Mitigate CVE-2026-50181

Immediate Actions Required

Upgrade Langroid to version 0.64.0 or later in all environments that expose file tools.
Inventory applications importing ReadFileTool or WriteFileTool from langroid.agent.tools.file_tools and prioritize those exposed to untrusted input.
Run the agent process under a least-privileged OS account with filesystem access limited to the intended workspace.

Patch Information

Version 0.64.0 patches the issue by introducing safe_resolve_path in langroid/utils/system.py and applying it inside ReadFileTool and WriteFileTool. The helper resolves symlinks and rejects absolute paths, .. segments, and any target outside base_dir. See the GitHub Security Advisory GHSA-fg23-3346-88f5 and the patch commit.

Workarounds

If upgrading is not immediately possible, wrap tool handlers to validate file_path with a resolve-and-contain check equivalent to safe_resolve_path before invoking the underlying tool.
Run the Langroid agent inside a container or chroot with only the intended workspace mounted read-write and sensitive host paths excluded.
Remove ReadFileTool and WriteFileTool from the enabled tool list for agents exposed to untrusted users or prompt injection.

bash

# Upgrade Langroid to the patched release
pip install --upgrade 'langroid>=0.64.0'

# Verify installed version
python -c "import langroid; print(langroid.__version__)"