From cd05fec1bca06056f20eea95644ead7235cc3459 Mon Sep 17 00:00:00 2001
From: "corridor-security[bot]"
 <203152403+corridor-security[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 03:15:53 +0000
Subject: [PATCH] Fix: Fix Path Traversal in cli.py

---
 libs/cli/langgraph_cli/deploy.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/libs/cli/langgraph_cli/deploy.py b/libs/cli/langgraph_cli/deploy.py
index 822028cb2..16158cd29 100644
--- a/libs/cli/langgraph_cli/deploy.py
+++ b/libs/cli/langgraph_cli/deploy.py
@@ -509,7 +509,12 @@ def _resolve_env_path(
     if isinstance(env_field, dict) and env_field:
         return None
     if isinstance(env_field, str):
-        env_path = (config_path.parent / env_field).resolve()
+        project_root = config_path.parent.resolve()
+        env_path = (project_root / env_field).resolve()
+        if not env_path.is_relative_to(project_root):
+            raise click.UsageError(
+                f"env file '{env_field}' specified in langgraph.json resolves outside the project directory."
+            )
         if not env_path.exists():
             _get_emitter().note(
                 f"Warning: env file '{env_field}' specified in langgraph.json not found."