High

LangChain LocalFileStore Path Traversal Invocation

LangChain's LocalFileStore, a simple file-based cache used by AI agents, does not clean up the file paths it builds from caller-supplied keys. An attacker who can influence a key value can use '../' sequences to escape the intended storage folder and read or write files anywhere the agent process has permission to touch.

How the attack works

An AI agent tool call ends up running an inline Python command (e.g. python -c) that imports LangChain's LocalFileStore and calls one of its key-based methods: mset, mget, mdelete, or yield_keys. If the key passed to that method contains a directory-traversal sequence like '../../../etc/cron.d/payload', LocalFileStore joins it onto its root directory without checking the result, so the operation lands outside the intended cache directory. This lets the attacker read sensitive files or write a new file - such as a cron job or config - with the same privileges as the agent process.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
6f1a7c92-3d84-4e05-9b7c-2a5f0c1d84e3
Severity
High

Why it matters

Arbitrary file read or write on the host running the agent, which can lead to secret disclosure, configuration tampering, or persistence (e.g. planting a scheduled task) - all at the privilege level of the agent process.

What you can do

  • →Pin LangChain to a version that sanitises or rejects traversal sequences in LocalFileStore keys, or wrap key inputs with your own path-normalisation and root-containment check before use.
  • →Never construct LocalFileStore keys directly from user or model-generated input; validate against an allow-list of expected key patterns.
  • →Run agent processes with the minimum filesystem permissions needed, so a successful traversal has limited reach.
  • →Review command-line logs for python -c/python3 -c invocations that combine LocalFileStore with mset/mget/mdelete/yield_keys and a '../' sequence, and treat this as one step of a larger chain rather than proof the write succeeded.

Known benign look-alikes

  • Developer or CI job running a LangChain example, notebook export, or ad-hoc one-liner that points LocalFileStore at a relative cache root such as ../../.cache and immediately calls mset/mget. Partially suppressed by the test-runner and packaging filters, and by requiring multi-level or sensitive-target traversal rather than any single "../".
  • Deliberate CVE reproduction or red-team validation of this exact issue in a sandbox. This is a true positive by pattern and is intentionally reported.
  • Security tooling or code search that prints a vulnerable snippet containing all three anchors on one command line - suppressed by filter_readonly_inspection.
  • Documentation or scaffold generators emitting template paths such as ../../path/to/cache - suppressed by filter_doc_placeholders.

References