StackRadar

CVE-2026-55443

Medium

Advisory

Published 16 Jun 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.5
base score, highest
EPSS
0.002
11th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
21
of 17,781 indexed, latest versions
Container images
20
deployed by those charts
Fix available
2 of 2
affected packages

LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 20 images.

Affected packageAffected versionsFixed inImages
langchainpypi0.1.6, 0.1.17, 0.1.20, 0.2.10+9 more1.3.919
langchain-anthropicpypi0.3.14, 1.3.4, 1.4.01.4.63
OSV records
GHSA-gr75-jv2w-4656PYSEC-2026-2192
Also known as
PYSEC-2026-2556

Charts affected

21 by stars
ChartLatestAffected imagesRadar Score
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
langchain@0.1.17
1.3.9

Open the chart page →

17,404
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
langchain@0.1.6
1.3.9

Open the chart page →

11,205
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
langchain@0.3.9
1.3.9

Open the chart page →

1,696
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
langchain@0.3.27
1.3.9

Open the chart page →

12,907
baserowblackbird-cloudVerified publisher1.0.171 of 6See more

baserow blackbird-cloud 1.0.17

1 of the 6 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
baserow/backend:1.31.1e0b3c8130b91
langchain@0.1.17
1.3.9

Open the chart page →

10,145
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
langchain@0.2.10
1.3.9

Open the chart page →

4,042
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
langchain@0.3.23
langchain-anthropic@0.3.14
1.3.9
1.4.6
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
langchain@1.2.12
langchain-anthropic@1.3.4
1.3.9
1.4.6

Open the chart page →

58,897
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
langchain@1.1.0
1.3.9

Open the chart page →

2,736
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
langchain@0.3.14
1.3.9

Open the chart page →

5,062
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
langchain@0.3.23
1.3.9

Open the chart page →

8,405
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
langchain-anthropic@1.4.0
1.4.6

Open the chart page →

2,555
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
langchain@0.1.20
1.3.9

Open the chart page →

18,922
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
langchain@0.3.20
1.3.9

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
langchain@0.3.20
1.3.9

Open the chart page →

4,718
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
langchain@1.2.15
1.3.9

Open the chart page →

1,556
chatqnatest-opea1.0.02 of 11See more

chatqna test-opea 1.0.0

2 of the 11 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
langchain@0.3.0
1.3.9
opea/retriever-redis:1.0eb746b263705
langchain@0.3.0
1.3.9

Open the chart page →

39,090
docsumtest-opea1.0.01 of 5See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/llm-docsum-tgi:1.002f9e8fa5d71
langchain@0.3.0
1.3.9

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
langchain@0.3.0
1.3.9

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
langchain@0.3.0
1.3.9

Open the chart page →

5,221
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
langchain@0.3.0
1.3.9

Open the chart page →

5,198
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-55443.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
langchain@0.3.0
1.3.9

Open the chart page →

5,350

Container images carrying it

20 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
opea/embedding-tei:1.05c9639de61c1
langchain@0.3.0
1.3.9
2
opea/retriever-redis:1.0eb746b263705
langchain@0.3.0
1.3.9
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
langchain@0.3.20
1.3.9
2
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
langchain@0.3.23
1.3.9
1
baserow/backend:1.31.1e0b3c8130b91
langchain@0.1.17
1.3.9
1
baserow/baserow:1.30.1df0c42eb67e8
langchain@0.1.17
1.3.9
1
ilum/streamlit-example:1.0.0ce5dcdeb22ba
langchain@1.1.0
1.3.9
1
opea/guardrails-tgi:1.0262c6048aab8
langchain@0.3.0
1.3.9
1
opea/guardrails-tgi:latestf68bec6a1271
langchain@0.3.14
1.3.9
1
opea/llm-docsum-tgi:1.002f9e8fa5d71
langchain@0.3.0
1.3.9
1
opea/web-retriever-chroma:1.0fe08165d7770
langchain@0.3.0
1.3.9
1
opencsghq/agenticflow:ee-v0.6-52f03fead54db
langchain@0.3.23
langchain-anthropic@0.3.14
1.3.9
1.4.6
1
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
langchain@1.2.12
langchain-anthropic@1.3.4
1.3.9
1.4.6
1
sruthitanneru/pi-sample:ui-lateste565ea454ffd
langchain@0.3.9
1.3.9
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
langchain@0.3.27
1.3.9
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
langchain@0.1.6
1.3.9
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
langchain@0.2.10
1.3.9
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
langchain@1.2.15
1.3.9
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
langchain-anthropic@1.4.0
1.4.6
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
langchain@0.1.20
1.3.9
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.