CVE-2026-50181 Details

A path traversal vulnerability has been identified in Langroid's file handling tools, specifically in versions through 0.63.0. The issue arises because the ReadFileTool and WriteFileTool do not properly enforce directory boundaries when performing file operations. Instead of validating that the final file path remains within the designated current directory, the tools allow traversal sequences to escape this boundary. This flaw can be exploited to read or write files outside the intended workspace, potentially exposing sensitive information or modifying files in unintended ways. The vulnerability is particularly concerning in applications that delegate file operations to an LLM agent or similar user-controlled context.

Users are advised to update to Langroid version 0.64.0 or later, where this vulnerability has been patched. In addition, applications should ensure that file paths are properly validated to prevent traversal outside of intended directory boundaries.