CVE-2026-26019

MEDIUM EPSS 29.0%
Published Feb 11, 20264mo ago · Modified Jun 17, 20261w ago
4.1 CVSS 3.1
Medium
Find Similar
Published Feb 11, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.

CVSS Details

Base Score
4.1
Exploitability
2.3
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Changed
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
29.0% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
langchainlangchain_community* <1.1.14

References 4

  • github.com https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
    Patch
  • github.com https://github.com/langchain-ai/langchainjs/pull/9990
    Issue TrackingPatch
  • github.com https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
    Release Notes
  • github.com https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
    Vendor Advisory

Remediation

  • github.com https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
    Patch
  • github.com https://github.com/langchain-ai/langchainjs/pull/9990
    Issue TrackingPatch