Kpanuragh

**Name of the Vulnerable Software and Affected Versions** LangChain versions prior to 1.1.14 **Description** The RecursiveUrlLoader class within the @langchain/community component is a web crawler that recursively follows links from a starting URL. The `preventOutside` option, intended to restrict crawling to the same site, used `String.startsWith()` for URL comparison, which does not perform semantic URL validation. This allowed attackers controlling crawled page content to include links to attacker-controlled or internal infrastructure by exploiting domains sharing a string prefix with the target. The crawler also lacked validation against private or reserved IP addresses, enabling access to cloud metadata services, localhost, and RFC 1918 addresses. An attacker influencing crawled page content could potentially fetch cloud instance metadata, access internal services on private networks, connect to localhost services, or exfiltrate response data. The issue is exploitable in environments where the crawler has access to cloud metadata or internal services. **Recommendations** Versions prior to 1.1.14 should be upgraded to version 1.1.14 or later.