{"data":{"id":"1610e3cb-2328-451c-bb90-e7a04230b884","title":"CVE-2024-3095: A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of…","summary":"CVE-2024-3095 is a Server-Side Request Forgery (SSRF) flaw in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The component does not restrict requests to remote internet addresses, so it can reach local addresses, enabling port scans, access to local services and, in some cases, cloud instance metadata. Only GET requests are possible, but the flaw can still expose stolen credentials and state-changing calls to internal APIs.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-3095","publishedAt":"2024-06-06T23:15:59.160Z","cveId":"CVE-2024-3095","cweIds":["CWE-918"],"cvssScore":"7.7","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langchain-community@< 0.2.9 (fixed: 0.2.9)"],"affectedPackageNames":["langchain-community"],"affectedPackageRefs":["pypi:langchain-community"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LangChain","Web Research Retriever"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"langchain Web Research Retriever SSRF to local and internal addresses","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00691,"epssCheckedAt":"2026-11-04T18:09:14.469Z","kevDateAdded":null,"advisoryAliases":["GHSA-q25c-c977-4cmh"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:47.014Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-07-19T22:56:37.886Z","daysToFix":43,"fixCheckedAt":"2026-10-29T21:45:50.005Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langchain-community","fixedVersion":"0.2.9","matchedVersion":"0.2.9","fixReleasedAt":"2024-07-19T22:56:37.886Z","daysToFix":43,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:49.855Z"}]}}