LangChain Text Splitters CVE-2026-41481

Exploitation requires three concurrent conditions: (1) The application must call HTMLHeaderTextSplitter.split_text_from_url() with a URL that the attacker controls or can influence - this is the intended API design, so any application that ingests user-supplied or third-party URLs via this function is in scope. (2) The redirect target must be an internal endpoint that does not require special request headers for access - AWS IMDSv1 (169.254.169.254) and unauthenticated internal admin APIs are confirmed viable targets; AWS IMDSv2, GCP IMDS, and Azure IMDS are explicitly NOT reachable because they require vendor-specific request headers that the redirect cannot inject. (3) Data exfiltration as an impact requires the application to return Document object contents or derivatives back to the party who supplied the URL - applications that process Documents internally without reflecting content to the requester are not exposed to the exfiltration path, though the unauthorized SSRF request to internal endpoints still occurs. The CVSS PR:N metric confirms that no authentication to the LangChain application itself is required beyond the ability to supply a URL.

The vendor-assigned CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects a moderate severity, though the UI:R metric deserves scrutiny - it represents not an end-user clicking something, but a developer or application passing an attacker-controlled URL into the vulnerable function, which is precisely the intended use case of the API. This makes the 'user interaction' threshold effectively zero in real deployments designed to accept external URLs. Against that, EPSS of 0.03% at the 9th percentile and SSVC exploitation status of 'none' indicate no observed exploitation activity. The SSVC 'automatable: no' assessment aligns with the application-architecture dependency for full data exfiltration - exploitation is not fire-and-forget. The SSVC 'technical impact: partial' correctly captures that impact is bounded by what the application does with Documents. There is no KEV listing and no known POC. The net risk profile is: real vulnerability with a confirmed attack path, but exploitation requires a specific application architecture pattern (accepting attacker URLs AND surfacing Document content to the requester), which limits practical blast radius. Priority should be elevated for LLM applications that accept user-supplied URLs for document ingestion and return processed content to end users.

An attacker submits a crafted URL pointing to a server they control (e.g., https://attacker.example.com/redirect) to a LangChain-powered application that passes user-supplied URLs to HTMLHeaderTextSplitter.split_text_from_url(). The initial validate_safe_url() check passes because the hostname resolves to a public IP. The attacker's server responds with a 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). Because no POC is publicly available, this scenario is reconstructed from the GHSA advisory description and the CVSS attack vector rather than observed attacker behavior.