TI-2024-00218 Aliases CVE-2024-0243 GHSA-h9j7-5xvc-qhg5

Server-side Request Forgery In Recursive URL Loader

HIGH 68CWE-918Published 2024-02-24 · Updated 2025-04-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resolved in https://github.com/langchain-ai/langchain/pull/15559

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00517 44th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed langchain-ai/langchain (langchain-ai): 0.1.0langchain (PyPI): 0.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langchain-ai	langchain-ai/langchain	before 0.1.0	0.1.0	Patch available	CNA
—	langchain (PyPI)	before 0.1.0	0.1.0	Patch available	GHSA-h9j7-5xvc-qhg5

langchain-ai/langchain Vendorlangchain-ai Affected before 0.1.0 Fixed in 0.1.0 Patch available CNA
langchain (PyPI) Vendor— Affected before 0.1.0 Fixed in 0.1.0 Patch available GHSA-h9j7-5xvc-qhg5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:langchain:langchain::::::::	before 0.1.0	Vulnerable	langchain-ai

cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:* Versions before 0.1.0 Vulnerable ·langchain-ai

Remediation

Fix · CNA langchain-ai/langchain (langchain-ai) Fixed in 0.1.0
Fix · GHSA-h9j7-5xvc-qhg5 langchain (PyPI) Fixed in 0.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-0243
2026-10-03 Alias added: GHSA-h9j7-5xvc-qhg5

References

Exploit 1

https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-0243

Other 3

TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
TI-2023-18176 An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because… CVSS 3.1CRITICAL 9.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences