GHSA-gr75-jv2w-4656

Affected versions of the LangChain components are vulnerable to Path Traversal due to improper validation of resolved filesystem paths. The file-search middleware and configuration loaders fail to confine resolved paths to the intended root directory, allowing glob patterns and symlinks to access files outside the configured root. An attacker can exploit this by providing crafted path values or search patterns, potentially leading to the unauthorized disclosure of files outside their intended boundaries.