NVIDIA LangChain package leaked local files via image inputs

A flaw in NVIDIA's langchain-nvidia-ai-endpoints Python package allowed attacker-supplied file paths to be read from the host and sent to a remote model endpoint, according to a GitHub security advisory published on 24 September 2026.

The advisory, tracked as GHSA-g28h-2cmm-rj9x, says versions of the package before 1.4.2 accepted local filesystem paths as image inputs for Vision Language Model requests. A Vision Language Model, or VLM, is a model that takes images as well as text. If an application passed attacker-controlled image input to the ChatNVIDIA class or to VLM reranking APIs, the advisory says, an attacker could cause files readable by the application process to be read and included in the outbound request to the configured NVIDIA or NIM model endpoint.

The practical effect is local file disclosure. Data that the application process can read on disk, such as configuration files or credentials held on the filesystem, could be packaged up as an "image" and shipped off the machine. The advisory does not describe any known exploitation.

Not every deployment is exposed. According to the advisory, applications are affected if they use VLM image inputs with ChatNVIDIA or NVIDIARerank and allow untrusted users to control image URLs or document image metadata. Applications that do not use VLM image inputs, or that only pass trusted image references, are not affected. That second condition matters for agent builders, because document metadata is often assembled from retrieved content rather than typed directly by a user, and retrieved content is frequently untrusted.

NVIDIA has published a fix. The advisory says users should upgrade to langchain-nvidia-ai-endpoints version 1.4.2 or later. The patched version rejects raw local filesystem paths for VLM image inputs. Supported inputs after the fix are remote URLs, data:image/...;base64,... URIs, and supported asset or file IDs.

For teams that cannot upgrade immediately, the advisory recommends rejecting local filesystem paths in any user-controlled VLM image input, and allowing only trusted remote URLs, data URIs, or known safe asset and file IDs. It also advises running applications with least-privilege filesystem access, so the application process cannot read files it does not need. That second measure limits the blast radius of similar bugs rather than fixing this one.

The pattern here is familiar from other agent tooling. A convenience feature that resolves a string into content, in this case turning a path into image bytes, becomes a data exfiltration channel once the string can come from someone outside the trust boundary. The same input field serves two very different purposes: a pointer to a public image on the internet, and a pointer to something on the local disk. The fix, as applied by NVIDIA, is to remove the second behaviour rather than try to filter it.

Developers running retrieval or reranking pipelines that attach images to documents should check which version of the package is pinned in their dependency files, and whether any image reference in those pipelines originates outside their own systems.