CVE-2026-41481
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In LangChain before version 1.1.2, an SSRF vulnerability exists in HTMLHeaderTextSplitter.split_text_from_url(). Although the initial URL is validated, redirects are not checked, allowing an attacker to access internal network resources.
Risk Assessment
The risk involves potential data exfiltration from internal servers, cloud, or localhost if the application returns processed documents to the user. Organizations may lose confidential information.
Recommendation
Immediately update the langchain-text-splitters library to version 1.1.2 or later. Additionally, consider disabling redirects in HTTP requests or implementing custom redirect validation.
Other vulnerabilities in LangChain
See all- CVE-2025-68664Critical
LangChain, a framework for building agents and LLM-powered applications, prior to versions 0.3.81 and 1.2.5 has a serialization injection vulnerability in its dumps() and dumpd() functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries. The 'lc' key is used internally by LangChain to mark serialized objects. When user-controlled data contains this key structure, it is treated as a legitimate LangChain object during deserialization rather than plain user data.
- CVE-2023-36095Critical
A vulnerability in LangChain version 0.0.194 allows remote code execution via the from_math_prompt and from_colored_object_prompt functions in the PALChain class. An attacker can inject malicious Python code through the eval mechanism.
- CVE-2023-36258Critical
An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.
- CVE-2023-34541Critical
Langchain version 0.0.171 is vulnerable to arbitrary code execution in the load_prompt function.
- CVE-2026-44843High
Vulnerability in LangChain before versions 0.3.85 and 1.3.3. Older runtime code paths deserialize inputs/outputs using overly broad object allowlists, allowing an attacker to supply malicious constructor dictionaries and instantiate objects with dangerous arguments.
- CVE-2026-34070High
A vulnerability in LangChain prior to version 1.2.22 allows arbitrary file read via directory traversal or absolute path injection in prompt configurations. Attackers can use load_prompt() or load_prompt_from_config() to read files, limited only by file extensions (.txt, .json, .yaml).
- CVE-2024-58340High
A ReDoS vulnerability in LangChain up to version 0.3.1 exists in the MRKLOutputParser.parse() method. An attacker can supply crafted text (e.g., via prompt injection) causing excessive CPU consumption and parsing delays, leading to denial of service.
Original NVD description (English source)
LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The response body is parsed and returned as Document objects to the calling application code. Whether this constitutes a data exfiltration path depends on the application: if it exposes Document contents (or derivatives) back to the requester who supplied the URL, sensitive data from internal endpoints could be leaked. Applications that store or process Documents internally without returning raw content to the requester are not directly exposed to data exfiltration through this issue. This vulnerability is fixed in 1.1.2.