AG-PATH-TRAVERSAL: Path Traversal

What this rule means

A function uses a tool-controlled path in a file read/write/delete sink with no normalization or containment check. `os.path.join` with a `..` segment does not contain the path — a parameter like `../../etc/passwd` or `../../.bashrc` escapes any intended base directory.

Why it matters

CVE-2026-34070 (CVSS 7.5): `langchain-core`'s `load_prompt` allowed path traversal; fixed in 1.2.22. (The function enforces a `.txt`/`.json`/`.yaml` extension allowlist, so claims of `.env` or credential-file exfiltration via this specific CVE are false — the traversal is real, the blast radius is narrower than sometimes reported.)

How to fix it

Resolve the path, then verify it is still inside the intended base directory (`Path.resolve()` + a prefix check) before any file operation.

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-PATH-TRAVERSAL          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules