GHSA-h9j7-5xvc-qhg5 CVE-2024-0243 PYSEC-2024-235 PYSEC-2026-1509

langchain Server-Side Request Forgery vulnerability

High PyPI

Severity: 3.7 / 10; High · CVSS 3.0
Exploit chance (EPSS): 0.52%; Chance of exploitation in the next 30 days. Higher than 44.00% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-918 Server-Side Request Forgery (SSRF)
Fix: Available; 2 packages have a fixed version

Description

With the following crawler configuration:

from bs4 import BeautifulSoup as Soup

url = "https://example.com"
loader = RecursiveUrlLoader(
    url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text 
)
docs = loader.load()

An attacker in control of the contents of https://example.com could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though prevent_outside=True.

https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51

Resolved in https://github.com/langchain-ai/langchain/pull/15559

Affected versions

PyPI

Package	Vulnerable	Fixed in
langchain	`< 0.1.0`	`0.1.0`
langchain-exa	`< 0.1.0`	`0.1.0`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

langchain PyPI → `0.1.0`

pip

pip install --upgrade "langchain>=0.1.0"

poetry

poetry add "langchain>=0.1.0"

uv

uv add "langchain>=0.1.0"

langchain-exa PyPI → `0.1.0`

pip

pip install --upgrade "langchain-exa>=0.1.0"

poetry

poetry add "langchain-exa>=0.1.0"

uv

uv add "langchain-exa>=0.1.0"

Severity breakdown

CVSS 3.0 3.7

CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack vector: Local
Attack complexity: High
Privileges required: High
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

Packages

Timeline

Feb 26, 2024 Published
Jul 7, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-gr75-jv2w-4656 LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders	Medium	Also affects langchain
GHSA-3644-q5cj-c5c7 LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning	High	Also affects langchain
GHSA-45pg-36p6-83v9 Langchain SQL Injection vulnerability	Critical	Also affects langchain
PYSEC-2024-323 LangChain pickle deserialization of untrusted data	High	Also affects langchain
GHSA-3hjh-jh2h-vrg6 Denial of service in langchain-community	Medium	Also affects langchain
GHSA-rgp8-pm28-3759 langchain vulnerable to path traversal	High	Also affects langchain
GHSA-h59x-p739-982c LangChain directory traversal vulnerability	High	Also affects langchain
GHSA-6h8p-4hx9-w66c Langchain Server-Side Request Forgery vulnerability	High	Also affects langchain

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor