CVE-2026-41481: langchain-text-splitters SSRF via redirects in HTMLHeaderTextSplitter

Summary

LangChain's langchain-text-splitters, prior to 1.1.2, validated the initial URL in HTMLHeaderTextSplitter.split_text_from_url() but fetched it with requests.get() while redirects were enabled and never revalidated redirect targets. An attacker-controlled URL could therefore redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. Exfiltration depends on the application: it is possible only if the returned Document contents are exposed back to the requester who supplied the URL.

Mitigation

Fixed in 1.1.2

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langchain-text-splittersPyPILLM dependency since 2024-03-01 · 6 tracked dependents

Related items

• MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
• HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
• MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
• MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database