AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

LowVulnerability

GHSA-h9j7-5xvc-qhg5: langchain Server-Side Request Forgery vulnerability

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2024-0243GHSA-h9j7-5xvc-qhg5
Published: February 26, 2024
Record updated: October 10, 2026

View JSON

Affected: langchain < 0.1.0
Fixed in: 0.1.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.5%

Summary

The langchain RecursiveUrlLoader in libs/community, in langchain_community/document_loaders/recursive_url_loader.py, can be made to fetch URLs outside the start site. An attacker who controls the content at the crawled URL can add links to other hosts, such as https://example.completely.different/my_file.html, and the crawler downloads them even when prevent_outside=True is set.

Mitigation

Resolved in https://github.com/langchain-ai/langchain/pull/15559

Details

Scores and exploitation

CVSS score: 3.7(low)
Patch available: Yes
CVSS vector: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector: local
Attack complexity: high
Privileges required: high
User interaction: required
EPSS: 0.5%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 10, 2026.
Disclosure date: February 26, 2024

Weaknesses and techniques

Weakness (CWE): CWE-918
Attack pattern (CAPEC): CAPEC-664

Affected

Packages: langchain@< 0.1.0 (fixed: 0.1.0)
Vendors: LangChain

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: RAG
Impact: Confidentiality,
Integrity
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-h9j7-5xvc-qhg5

First tracked: October 10, 2026 at 12:52 AM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 90% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

langchainPyPILLM dependency since 2022-10-25 · 30 tracked dependents

Summary

Mitigation

Affected packages in the Exposure Registry

Related items