Langchain Openai
Monthly
DNS rebinding in langchain-openai before 1.1.14 allows an attacker-controlled hostname to bypass SSRF protection in the image token-counting code path, enabling blind probing of internal network services. The `_url_to_size()` helper performs URL validation and the subsequent HTTP fetch as two independent operations with separate DNS resolution, creating a TOCTOU race window that a malicious domain with a short TTL can exploit to redirect the fetch to a private or localhost address after passing the initial check. Practical impact is bounded: the HTTP response is consumed only by Pillow for image dimension extraction and is never returned or logged, making data exfiltration impossible; SSVC confirms no active exploitation, EPSS sits at the 8th percentile, and no public exploit code exists at time of analysis.
DNS rebinding in langchain-openai before 1.1.14 allows an attacker-controlled hostname to bypass SSRF protection in the image token-counting code path, enabling blind probing of internal network services. The `_url_to_size()` helper performs URL validation and the subsequent HTTP fetch as two independent operations with separate DNS resolution, creating a TOCTOU race window that a malicious domain with a short TTL can exploit to redirect the fetch to a private or localhost address after passing the initial check. Practical impact is bounded: the HTTP response is consumed only by Pillow for image dimension extraction and is never returned or logged, making data exfiltration impossible; SSVC confirms no active exploitation, EPSS sits at the 8th percentile, and no public exploit code exists at time of analysis.