LangChain Server Side Request Forgery vulnerability

HIGH 8.8CVE-2023-46229 · GHSA-655w-fm8m-m478 · PYSEC-2023-205 · Published 19/10/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
langchain PyPI	`< 0.0.317`	`0.0.317`
langchain langchain	`< 0.0.317`	`0.0.317`

Description

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

NVD description

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

References

nvd.nist.gov/vuln/detail/CVE-2023-46229 · ADVISORY
langchain-ai/langchain#11925 · WEB
langchain-ai/langchain commit 9ecb724 · WEB
langchain-ai/langchain · PACKAGE
pypa/advisory-database · WEB
GitHub Advisory GHSA-655w-fm8m-m478 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free