PT-2026-35086 · Pypi · Langchain-Text-Splitters

Aeg1Sx · Published 2026-04-16 · Updated 2026-06-04 · CVE-2026-41481

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions langchain-text-splitters versions prior to 1.1.2

Description In the HTMLHeaderTextSplitter.split text from url() function, the initial URL is validated using validate safe url(), but the subsequent fetch is performed via requests.get() with redirects enabled. Since redirect targets are not revalidated, a URL pointing to an attacker-controlled server can redirect to internal, localhost, or cloud metadata endpoints, bypassing Server-Side Request Forgery (SSRF) protections. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. The response body is parsed and returned as Document objects. If the application exposes these contents back to the requester, sensitive data from internal endpoints could be leaked.

Recommendations Update langchain-text-splitters to version 1.1.2.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41481

GHSA-FV5P-P927-QMXR

PYSEC-2026-77

Affected Products

Langchain-Text-Splitters

References · 13

• https://github.com/langchain-ai/langchain/security/advisories/GHSA-fv5p-p927-qmxr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41481 · Security Note
• https://osv.dev/vulnerability/GHSA-fv5p-p927-qmxr · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-41481 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-77 · Vendor Advisory
• https://github.com/langchain-ai/langchain · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain-text-splitters/PYSEC-2026-77.yaml · Note
• https://twitter.com/VulmonFeeds/status/2047826059400282300 · Twitter Post
• https://twitter.com/Sattyamjjain/status/2048052297008398484 · Twitter Post
• https://twitter.com/_MrDecentralize/status/2053460197729812916 · Twitter Post
• https://twitter.com/Sattyamjjain/status/2048052075767255247 · Twitter Post
• https://twitter.com/CVEnew/status/2047798550416015395 · Twitter Post
• https://twitter.com/vuldb/status/2048022756642709957 · Twitter Post