{"data":{"id":"e08d52a1-f7a4-4deb-bf5d-be028cf95282","title":"CVE-2024-3571: langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted…","summary":"langchain-ai/langchain is vulnerable to path traversal in its LocalFileStore functionality, tracked as CVE-2024-3571. Because user-supplied input is not adequately sanitized in the mset and mget methods, directory traversal sequences can reach unintended directories. An attacker can read or write files anywhere on the filesystem, which could lead to information disclosure or remote code execution.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-3571","publishedAt":"2024-04-16T04:15:12.203Z","cveId":"CVE-2024-3571","cweIds":["CWE-22"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain@< 0.0.353 (fixed: 0.0.353)"],"affectedPackageNames":["langchain"],"affectedPackageRefs":["pypi:langchain"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","LocalFileStore"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain-ai/langchain path traversal in LocalFileStore mset and mget methods","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01871,"epssCheckedAt":"2026-11-04T18:09:14.312Z","kevDateAdded":null,"advisoryAliases":["GHSA-rgp8-pm28-3759"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:11.658Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2023-12-29T17:10:05.896Z","daysToFix":-109,"fixCheckedAt":"2026-10-29T21:46:07.711Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain","fixedVersion":"0.0.353","matchedVersion":"0.0.353","fixReleasedAt":"2023-12-29T17:10:05.896Z","daysToFix":-109,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:07.560Z"}]}}