Security brief
Historical advisory: LangChain LocalFileStore paths could escape their directory
REVIEWThe LocalFileStore issue concerns filesystem boundaries around user-influenced paths.
What happened
A reviewed April 2024 advisory describes path traversal in LangChain’s LocalFileStore. Inadequate validation in its storage operations could allow paths to reach outside the intended directory, exposing files or allowing writes. The advisory also describes possible code-execution consequences.
The package table lists versions before 0.0.353 as affected. This is historical coverage and should not be interpreted as evidence of a new campaign.
For inherited systems, identify whether LocalFileStore receives user-influenced names and compare the installed package with the advisory. A storage directory setting should not be assumed to enforce confinement by itself. Update affected dependencies and limit the filesystem permissions of the application process.
Who should check?
Maintainers using LocalFileStore in legacy LangChain deployments.
Next step
Check CVE-2024-3571 and update affected dependencies.
What we know
- Historical fixed version
- 0.0.353
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
GIT
Technical details
- CVE
CVE-2024-3571