CVE-2024-3571: High Path Traversal in LangChain LocalFileStore

CVE-2024-3571 is a high severity path traversal (CVSS 8.8) in the LocalFileStore feature of LangChain. Keys passed to mset and mget were not restricted to the store root, so files outside it could be read or written. The upstream commit confines keys to the root. The record gives no fixed version, so confirm in the release notes.

Weakness class: CWE-22.

What's affected

• Product: langchain-ai/langchain, the langchain Python package. The record names version 0.0.351 as an affected example.
• Component: LocalFileStore, in the mset and mget methods.
• Fix: the linked commit (pull request 15065) makes root_path absolute, resolves each key and checks with os.path.commonpath that it stays under the root, raising InvalidKeyException otherwise. The commit page does not give a release number.
• Severity: High, CVSS 8.8, per the record. The KEV flag is false.
• Fixed version: not confirmed here. Check the LangChain release notes.

How to check if you're exposed

1. Find the installed version: run pip show langchain in each environment.
2. Search for use of the store: run grep -rn "LocalFileStore" . over your applications.
3. Look for places where the key comes from user input, such as a session id, filename or tenant name.
4. Use the free in-browser dependency scan on your lock files to find environments with older langchain releases.

What to do now

1. Upgrade langchain to a release that includes the key containment fix.
2. Never use raw user input as a store key. Map user input to a generated identifier instead.
3. Run the application as a user that can only write to its own data directory.
4. If keys were attacker influenced, review the file system for unexpected files outside the store root.
5. Add a unit test that tries a parent directory key and expects an exception, mirroring the upstream test.

Why it matters

The class is CWE-22, improper limitation of a pathname to a restricted directory. A store that joins a base folder with a caller supplied key will follow sequences that climb out of the folder unless it checks the resolved path. The upstream fix is the standard one: resolve the full path, then confirm it still sits under the root.

The record notes the outcome could reach information disclosure or remote code execution, since writing a file to a chosen location can overwrite code or configuration. Whether that applies depends on how the application uses the store and what the process may write.

This is why reachability matters. If your app never feeds untrusted keys to LocalFileStore, the weak method exists in your dependency tree but is not reachable from outside. If it does, the risk is real and fast to fix.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• https://github.com/langchain-ai/langchain/commit/aad3d8bd47d7f5598156ff2bdcc8f736f24a7412
• Gold entry for CVE-2024-3571

Last reviewed: 19 October 2026.