Riskcovery

CVE-2024-0243

Server-side Request Forgery In Recursive URL Loader

State
Published
Severity
3.7 Low
Published
Feb 24, 2024
Updated
Apr 22, 2025
Reserved
Jan 4, 2024

Read the record on cve.org

Description

With the following crawler configuration:

```python from bs4 import BeautifulSoup as Soup

url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ```

An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`.

https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51

Resolved in https://github.com/langchain-ai/langchain/pull/15559

Scores

CVSSScoreVectorSource
3.03.7 LowCVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N@huntr_ai

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
langchain-ai/langchainlangchain-ai
  • before 0.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.