Skip to content
AI Sec Watch
LowVulnerability

GHSA-r7w7-9xr2-qq2r: langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-r7w7-9xr2-qq2r
Published
Record updated
View JSON
Affected
  • langchain-openai < 1.1.14
Fixed in
1.1.14

Summary

langchain-openai versions before 1.1.14 validated image URLs for SSRF protection in `_url_to_size()`, then fetched them with a separate DNS resolution, leaving a DNS rebinding window where a hostname could resolve to a public IP during validation and a private or localhost IP during the fetch. The fetched body is passed only to Pillow's `Image.open()` and never returned or logged, so an attacker cannot exfiltrate data, though blind probing of internal hosts and ports may be possible.

Mitigation

Fixed in langchain-openai 1.1.14 (requires langchain-core >= 1.2.31). The fix replaces validate-then-fetch with `SSRFSafeSyncTransport` from langchain-core, which resolves DNS once, validates returned IPs against a policy, pins the connection to the validated IP, and disables redirect following.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

Related items