| Package | Affected versions | Patched versions |
|---|---|---|
| langchain-core | < 1.2.11 | 1.2.11 |
| langchain core | < 1.2.11 | 1.2.11 |
The ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input.
Low - The vulnerability allows SSRF attacks but has limited impact due to:
An attacker who can control image URLs passed to get_num_tokens_from_messages() can:
Note: This vulnerability occurs during token counting, which may happen outside of model invocation (e.g., in logging, metrics, or token budgeting flows).
The vulnerable code path:
get_num_tokens_from_messages() processes messages containing image_url content blocksdetail: "low", it calls _url_to_size() to fetch the image and compute token counts_url_to_size() performs httpx.get(image_source) on any URL without validationFile: libs/partners/openai/langchain_openai/chat_models/base.py
The vulnerability has been patched in langchain-openai==1.1.9 (requires langchain-core==1.2.11).
The patch adds:
langchain_core._security._ssrf_protection.validate_safe_url() to block:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freehttpx.get default)allow_fetching_images=False parameterIf you cannot upgrade immediately:
image_url values before passing messages to token counting or model invocation