CVE-2024-3571: langchain Path Traversal Vulnerability
Summary
CVE-2024-3571: langchain vulnerable to path traversal. Affects langchain versions < 0.0.353. Fixed in 0.0.353. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Langchain is an open-source framework designed for building applications that utilize language models. It provides various functionalities, including file storage and retrieval through its LocalFileStore feature. However, it has been identified that the package is vulnerable to path traversal attacks, which can compromise the security of the filesystem.
Vulnerability Detail
The langchain package is vulnerable to path traversal due to improper validation of file paths in its LocalFileStore functionality. Specifically, the mset and mget methods do not adequately sanitize user-supplied input, allowing attackers to exploit directory traversal sequences. This vulnerability can lead to unauthorized reading or writing of files across the filesystem, potentially resulting in information disclosure or remote code execution.
How To Fix
Latest published version: 1.4.7 as of 22 Oct 2026
pip install --upgrade "langchain==1.4.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.353
This is the first release that contains the fix.
pip install --upgrade "langchain==0.0.353"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation in your application to sanitize file paths before passing them to the mset and mget methods. Ensure that user inputs do not contain any directory traversal sequences such as '../'.
Conclusion
The langchain package is vulnerable to a path traversal attack, which can lead to serious security issues if not addressed. Users are strongly advised to update to the latest version to mitigate this risk and implement additional input validation as a precaution.
See every vulnerability recorded for langchain →
FAQ
Path traversal is a security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory.
If exploited, this vulnerability can allow attackers to read sensitive files or execute arbitrary code on your server, leading to severe security breaches.
Yes, a patch is available in version 0.0.353 of the langchain package. It is recommended to upgrade to this version or later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 6.5, indicating a medium level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for langchain.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
