CVE-2024-3571: langchain vulnerable to path traversal

# CVE-2024-3571: langchain vulnerable to path traversal

https://gcdradar.vercel.app/incidents/cve-2024-3571-langchain-vulnerable-to-path-traversal · AIR-2024-0091 · closed 2024-04-16

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-04-16
- AI role: Attack on AI
- Products: langchain
- CVE ids: CVE-2024-3571
- CVSS: 6.5

## Summary

A path traversal vulnerability in LangChain's LocalFileStore functionality enables unauthorized file read or write operations. The vulnerability is fixed in version 0.0.353.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-04-16: CVE-2024-3571: langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path… (https://nvd.nist.gov/vuln/detail/CVE-2024-3571)
- 2024-04-16: CVE-2024-3571: langchain vulnerable to path traversal (https://github.com/advisories/GHSA-rgp8-pm28-3759)

## Sources

- 2024-04-16 GitHub Advisory Database: CVE-2024-3571: langchain vulnerable to path traversal https://github.com/advisories/GHSA-rgp8-pm28-3759
- 2024-04-16 NVD: CVE-2024-3571: langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory ('Path… https://nvd.nist.gov/vuln/detail/CVE-2024-3571

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.