Path Traversal Vulnerability in Langchain-AI's LocalFileStore Functionality

CVE-2024-3571

What is CVE-2024-3571?

LangChain's LocalFileStore contains a vulnerability that allows attackers to exploit improper pathname limitations, leading to potential access to sensitive files. The flaw arises when the system fails to adequately sanitize user-supplied input in the 'mset' and 'mget' methods, allowing malicious actors to execute directory traversal attacks. This oversight poses risks that could result in unauthorized file access or even remote code execution, compromising the security of systems utilizing this functionality.

References