PT-2026-7722 · Langchain+1 · Langchain+1

Kpanuragh

·

Published

2026-02-11

·

Updated

2026-03-04

·

CVE-2026-26019

CVSS v3.1

4.1

Medium

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions LangChain versions prior to 1.1.14
Description The RecursiveUrlLoader class within the @langchain/community component is a web crawler that recursively follows links from a starting URL. The preventOutside option, intended to restrict crawling to the same site, used String.startsWith() for URL comparison, which does not perform semantic URL validation. This allowed attackers controlling crawled page content to include links to attacker-controlled or internal infrastructure by exploiting domains sharing a string prefix with the target. The crawler also lacked validation against private or reserved IP addresses, enabling access to cloud metadata services, localhost, and RFC 1918 addresses. An attacker influencing crawled page content could potentially fetch cloud instance metadata, access internal services on private networks, connect to localhost services, or exfiltrate response data. The issue is exploitable in environments where the crawler has access to cloud metadata or internal services.
Recommendations Versions prior to 1.1.14 should be upgraded to version 1.1.14 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-26019
GHSA-GF3V-FWQG-4VH7

Affected Products

Langchain-Community
Langchain