GHSA-655w-fm8m-m478

LangChain Server Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-46229

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	langchain	< 0.0.317	0.0.317

Details

As written in the advisory (Markdown source, shown as plain text).

LangChain before 0.0.317 allows SSRF via `document_loaders/recursive_url_loader.py` because crawling can proceed from an external server to an internal server.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-46229 advisory
https://github.com/langchain-ai/langchain/pull/11925 web
https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8 web
https://github.com/langchain-ai/langchain package
https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-205.yaml web