CVE-2026-50181

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50181
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50181.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50181
Aliases
Published
2026-07-09T23:44:46.559Z
Modified
2026-08-12T03:51:36.206399781Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Langroid: Path traversal in the file tools allows read/write outside configured current directory
Details

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's ReadFileTool and WriteFileTool appear to treat curr_dir as the intended working-directory boundary for file operations. However, the tools only change the process working directory to curr_dir and then operate on the user-supplied file_path without resolving and enforcing that the final path remains inside curr_dir. As a result, a tool caller can supply path traversal sequences such as ../secret.txt to read files outside the configured current directory, or ../written_by_tool.txt to write files outside that directory. This can impact applications that expose Langroid file tools to an LLM agent, user-controlled tool call, or delegated coding/documentation agent while relying on curr_dir to restrict file access to a project/workspace directory. Version 0.64.0 patches the issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50181.json",
    "cwe_ids": [
        "CWE-22",
        "CWE-23"
    ]
}
References

Affected packages

Git / github.com/langroid/langroid

Affected ranges

Type
GIT
Repo
https://github.com/langroid/langroid
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
56e2756ecab70a70a7e6edbee2f2187b8484683e
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.64.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.100
0.1.101
0.1.103
0.1.104
0.1.106
0.1.107
0.1.109
0.1.110
0.1.113
0.1.116
0.1.118
0.1.119
0.1.120
0.1.122
0.1.124
0.1.127
0.1.128
0.1.130
0.1.131
0.1.132
0.1.133
0.1.134
0.1.135
0.1.136
0.1.137
0.1.138
0.1.139
0.1.140
0.1.142
0.1.143
0.1.144
0.1.146
0.1.147
0.1.148
0.1.149
0.1.150
0.1.151
0.1.152
0.1.153
0.1.155
0.1.158
0.1.159
0.1.16
0.1.160
0.1.161
0.1.162
0.1.164
0.1.165
0.1.166
0.1.167
0.1.168
0.1.169
0.1.17
0.1.170
0.1.171
0.1.172
0.1.173
0.1.176
0.1.177
0.1.178
0.1.179
0.1.18
0.1.180
0.1.181
0.1.183
0.1.184
0.1.185
0.1.186
0.1.188
0.1.189
0.1.191
0.1.192
0.1.194
0.1.196
0.1.198
0.1.199
0.1.20
0.1.200
0.1.201
0.1.202
0.1.203
0.1.205
0.1.206
0.1.207
0.1.208
0.1.209
0.1.21
0.1.210
0.1.212
0.1.213
0.1.214
0.1.216
0.1.217
0.1.218
0.1.219
0.1.22
0.1.221
0.1.222
0.1.224
0.1.225
0.1.226
0.1.227
0.1.228
0.1.229
0.1.23
0.1.230
0.1.231
0.1.232
0.1.233
0.1.234
0.1.235
0.1.236
0.1.237
0.1.238
0.1.239
0.1.24
0.1.240
0.1.241
0.1.242
0.1.243
0.1.244
0.1.245
0.1.246
0.1.247
0.1.248
0.1.25
0.1.250
0.1.251
0.1.253
0.1.254
0.1.256
0.1.258
0.1.261
0.1.262
0.1.265
0.1.27
0.1.28
0.1.29
0.1.30
0.1.31
0.1.32
0.1.33
0.1.34
0.1.35
0.1.36
0.1.38
0.1.42
0.1.43
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.52
0.1.54
0.1.55
0.1.61
0.1.62
0.1.64
0.1.66
0.1.69
0.1.73
0.1.81
0.1.82
0.1.83
0.1.84
0.1.86
0.1.87
0.1.89
0.1.90
0.1.92
0.1.94
0.1.96
0.1.97
0.1.98
0.1.99
0.10.0
0.10.1
0.11.0
0.12.0
0.13.0
0.14.0
0.15.0
0.15.1
0.15.2
0.16.0
0.16.1
0.16.2
0.16.3
0.16.4
0.16.5
0.16.6
0.16.7
0.17.0
0.17.1
0.18.0
0.18.1
0.18.2
0.18.3
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.19.5
0.2.11
0.2.12
0.2.2
0.2.3
0.2.4
0.2.7
0.2.8
0.2.9
0.20.0
0.20.1
0.21.0
0.22.0
0.22.1
0.22.2
0.22.3
0.22.4
0.22.5
0.22.6
0.22.7
0.23.0
0.23.1
0.23.2
0.23.3
0.24.0
0.24.1
0.25.0
0.26.0
0.26.1
0.26.2
0.27.0
0.27.1
0.27.2
0.27.3
0.27.4
0.28.0
0.28.1
0.28.2
0.28.3
0.28.4
0.28.5
0.28.6
0.28.7
0.29.0
0.3.1
0.30.0
0.30.1
0.31.0
0.31.1
0.31.2
0.31.3
0.32.0
0.32.1
0.32.2
0.33.0
0.33.10
0.33.11
0.33.12
0.33.13
0.33.2
0.33.3
0.33.4
0.33.5
0.33.6
0.33.7
0.33.8
0.33.9
0.34.0
0.34.1
0.35.0
0.35.1
0.36.0
0.36.1
0.37.0
0.37.1
0.37.2
0.37.3
0.37.4
0.37.5
0.37.6
0.37.7
0.38.0
0.39.0
0.39.1
0.39.2
0.39.3
0.39.4
0.39.5
0.4.0
0.40.0
0.41.0
0.41.1
0.41.2
0.41.3
0.41.4
0.41.5
0.42.0
0.42.1
0.42.10
0.42.2
0.42.3
0.42.4
0.42.5
0.42.6
0.42.7
0.42.8
0.42.9
0.43.0
0.43.1
0.44.0
0.44.1
0.45.0
0.45.1
0.45.10
0.45.2
0.45.3
0.45.4
0.45.5
0.45.6
0.45.7
0.45.8
0.45.9
0.47.0
0.47.1
0.47.2
0.48.0
0.48.1
0.48.2
0.48.3
0.49.0
0.49.1
0.5.0
0.5.1
0.50.0
0.50.1
0.50.10
0.50.11
0.50.12
0.50.2
0.50.3
0.50.4
0.50.5
0.50.6
0.50.7
0.50.8
0.50.9
0.51.0
0.51.1
0.51.2
0.52.0
0.52.1
0.52.2
0.52.3
0.52.5
0.52.6
0.52.7
0.52.8
0.52.9
0.53.10
0.53.12
0.53.13
0.53.14
0.53.15
0.53.16
0.53.2
0.53.3
0.53.4
0.53.5
0.53.6
0.53.7
0.53.8
0.53.9
0.54.0
0.54.1
0.54.2
0.55.0
0.55.1
0.56.0
0.56.1
0.56.10
0.56.11
0.56.12
0.56.13
0.56.14
0.56.15
0.56.16
0.56.17
0.56.18
0.56.19
0.56.2
0.56.3
0.56.4
0.56.5
0.56.6
0.56.7
0.56.8
0.56.9
0.57.0
0.58.0
0.58.1
0.58.2
0.58.3
0.59.0
0.59.1
0.59.10
0.59.11
0.59.12
0.59.13
0.59.14
0.59.15
0.59.16
0.59.17
0.59.18
0.59.19
0.59.2
0.59.20
0.59.21
0.59.22
0.59.23
0.59.24
0.59.25
0.59.26
0.59.27
0.59.28
0.59.29
0.59.3
0.59.30
0.59.31
0.59.32
0.59.33
0.59.34
0.59.35
0.59.36
0.59.37
0.59.38
0.59.39
0.59.4
0.59.5
0.59.6
0.59.7
0.59.8
0.59.9
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.60.0
0.60.1
0.60.2
0.60.3
0.61.0
0.61.1
0.62.0
0.63.0
0.7.0
0.8.0
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
v0.*
v0.59.0
v0.59.19

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50181.json"