# LangChain Sandbox Escape Path or Glob Argument

- **Severity:** Medium
- **Signature ID:** `7b3f1c2e-9d64-4a51-bf08-2c6d5a41e9c7`
- **OWASP:** LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

This rule flags file paths, directory names, or glob patterns given to an AI agent's file-search or document-loading tool that look designed to escape the folder the tool is supposed to be confined to. It catches the request before it runs, not proof that the escape actually succeeded.

## How the attack works

An attacker (or a compromised prompt/config) supplies a path, glob, or search pattern to an AI agent's file tool that contains stacked '../' segments, an encoded traversal, a glob that climbs above its root or targets system directories, or a symlink pointed at a parent path or credential file. LangChain-based file-search components check the starting root but not where the path actually resolves to, so a crafted argument can walk outside the intended directory tree. If the resolution step actually escapes, the agent can read files it was never meant to access, such as credentials or configuration outside the sandbox. The rule only sees the argument as submitted, not what the tool actually opened, so it reports rather than blocks.

## Why it matters

If successful, this class of flaw lets an AI agent read files outside its authorized directory, exposing credentials, configuration, or other sensitive data that should have been walled off from the agent.

## What you can do

- Enforce path resolution checks (e.g. realpath/canonicalization) after any user- or LLM-influenced path is built, not just at the configured root.
- Deny symlinks inside directories that AI agents can read from, or resolve and re-validate symlink targets before allowing access.
- Run file-search and document-loading tools under a filesystem sandbox or restricted service account that cannot reach credential or system paths even if traversal succeeds.
- Log and review tool calls where the traversal lands on a credential-like filename, and correlate with subsequent file-read activity.

## Known benign look-alikes

- Monorepo tooling that legitimately reaches several levels up into sibling workspaces ("../../../packages/core/src/index.ts") \u2014 suppressed by filter_monorepo_relative, which only clears deep traversals that land in a known source/build directory and contain no dot-prefixed segment.
- Documentation, README or scaffolding content that carries placeholder paths such as "path/to/file" or "${PROJECT_ROOT}" \u2014 suppressed by filter_placeholder_path.
- Security training material, SBOM notes or advisory text that quotes CWE-22 / CWE-59 traversal examples \u2014 suppressed by filter_vuln_documentation.
- Build tooling that legitimately globs an absolute system directory it owns (for example a container image build listing /var/log) \u2014 will still report; triage by checking whether the calling tool is a sandboxed loader.
- Developer-initiated "ln -s" of a dotfile into a home directory during environment setup \u2014 will still report; low volume and worth an audit line.

## References

- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/59.html
- https://owasp.org/www-project-top-10-for-large-language-model-applications/

---
Source: https://www.netzilo.com/threats/langchain-path-traversal-glob-escape