TI-2024-02899 Aliases CVE-2024-3095 GHSA-q25c-c977-4cmh

SSRF in Langchain Web Research Retriever in langchain-ai/langchain

HIGH 67CWE-918Published 2024-06-06 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This flaw enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from cloud environments. The vulnerability is particularly concerning as it can be exploited to abuse the Web Explorer server as a proxy for web attacks on third parties and interact with servers in the local network, including reading their response data. This could potentially lead to arbitrary code execution, depending on the nature of the local services. The vulnerability is limited to GET requests, as POST requests are not possible, but the impact on confidentiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing interactions with internal APIs.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00691 53rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed langchain-community (PyPI): 0.2.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
langchain-ai	langchain-ai/langchain	up to latest	—	No fix listed	CNA
—	langchain-community (PyPI)	before 0.2.9	0.2.9	Patch available	GHSA-q25c-c977-4cmh

langchain-ai/langchain Vendorlangchain-ai Affected up to latest Fixed in — No fix listed CNA
langchain-community (PyPI) Vendor— Affected before 0.2.9 Fixed in 0.2.9 Patch available GHSA-q25c-c977-4cmh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:langchain:langchain::::::::	0.1.5 to before 0.2.9	Vulnerable	langchain-ai

cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:* Versions 0.1.5 to before 0.2.9 Vulnerable ·langchain-ai

Remediation

Fix · GHSA-q25c-c977-4cmh langchain-community (PyPI) Fixed in 0.2.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-3095
2026-10-03 Alias added: GHSA-q25c-c977-4cmh

References

Exploit 1

https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-3095

Other 4

TI-2023-20724 An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20706 An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2023-20166 An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
TI-2023-20136 An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. CVSS 3.1CRITICAL 9.8
TI-2023-18185 An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
TI-2023-18176 An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because… CVSS 3.1CRITICAL 9.8

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences