Skip to content
AI Sec Watch
MediumVulnerability

GHSA-fv5p-p927-qmxr: LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-fv5p-p927-qmxr
Published
Record updated
View JSON
Affected
  • langchain-text-splitters < 1.1.2
Fixed in
1.1.2

Summary

LangChain Text Splitters before 1.1.2 has an SSRF bypass in HTMLHeaderTextSplitter.split_text_from_url(). The function validates only the initial URL with validate_safe_url() and then calls requests.get() with redirects enabled, so an attacker-controlled server can redirect the fetch to internal, localhost or cloud metadata endpoints such as AWS IMDSv1. Data exfiltration requires the application to return Document contents to the party that supplied the URL.

Mitigation

Fixed in langchain-text-splitters 1.1.2 (requires langchain-core >= 1.2.31), which replaces requests.get() with the SSRF-safe SSRFSafeSyncTransport from langchain-core that validates DNS results and pins connections on every request, including redirect targets. split_text_from_url() is also deprecated; users should fetch HTML themselves and pass it to split_text().

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

Related items