EUVD-2026-63732
GHSA-vg8m-4p2q-gcjh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with no privileges needed; scope changed because internal systems are the disclosure targets, not the LangChain host; no integrity or availability impact observed.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no domain comparison and no check for private, loopback or link-local destinations. An attacker who controls or influences an ingested sitemap can therefore point a nested sitemap entry at an internal address and make the server fetch it even when the deploying application set restrict_to_same_domain to True specifically to confine outbound requests. The fetched content is parsed and surfaces in the returned Documents, so internal responses are disclosed to the caller rather than merely requested.
AnalysisAI
SSRF in langchain-community's SitemapLoader defeats the documented restrict_to_same_domain security control by failing to apply it to nested sitemap index entries, allowing an attacker who influences an ingested sitemap to exfiltrate responses from internal network resources including loopback, link-local, and RFC-1918 addresses. Any LangChain-based pipeline consuming attacker-influenced sitemaps is affected; the CVSS 4.0 score of 7.7 reflects high confidentiality impact on downstream internal systems (SC:H) with no authentication or complexity requirements. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The application must be using `SitemapLoader` from the langchain-community package to ingest sitemaps. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 7.7 CVSS 4.0 score is driven entirely by SC:H - the vulnerable system (the LangChain process) shows no self-impact (VC/VI/VA all N), accurately modelling SSRF: the application is co-opted as a proxy, with internal services as the actual disclosure targets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who controls or has compromised a public website hosts a sitemap index file containing a nested `<sitemap><loc>http://169.254.169.254/latest/meta-data/</loc></sitemap>` entry pointing at the cloud instance metadata endpoint. When a LangChain RAG pipeline with `restrict_to_same_domain=True` processes this sitemap, the nested entry skips domain validation, triggering an `aiohttp` GET to the metadata endpoint; the response - potentially containing IAM credentials or instance identity documents - is deserialized and returned inside the pipeline's `Document` objects, disclosing it to whoever invoked the ingestion job. … |
| Remediation | Upgrade langchain-community to a patched release as the primary fix; monitor the upstream repository at https://github.com/langchain-ai/langchain-community and the tracking issue at https://github.com/langchain-ai/langchain/issues/38814 for a confirmed fix version - no specific patched release has been independently verified at time of analysis, and the VulnCheck advisory at https://www.vulncheck.com/advisories/langchain-community-sitemaploader-does-not-apply-restrict-to-same-domain-to-nested-sitemap-index-entries-allowing-server-side-request-forgery should be monitored for updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running langchain-community (determine currently deployed versions through dependency manifests) and flag systems using SitemapLoader or sitemap-based document ingestion. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today