Executive brief
LangChain's ChatOpenAI token counting method fetches image URLs without validation when processing vision-enabled model inputs. An attacker who can provide image URLs to the application can force the server to make HTTP requests to arbitrary internal or external addresses, potentially accessing private networks or cloud metadata endpoints.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the ChatOpenAI.get_num_tokens_from_messages() method, which calls _url_to_size() to fetch and measure images for token counting without URL validation. The vulnerable code performs httpx.get() on attacker-controlled image_url values without checking for private IP ranges, loopback addresses, or cloud metadata endpoints. Token counting may occur outside of direct model invocation—such as in logging, metrics, and budgeting flows—expanding the attack surface. The impact is limited to blind SSRF (no response returned to attacker) with a 5-second timeout and PIL image parsing requirements, preventing full data exfiltration. The patch (langchain-openai 1.1.9, requiring langchain-core 1.2.11) adds URL validation, size limits (50 MB), and an explicit timeout.
Affected products
- LangChain langchain-core before 1.2.11
- LangChain langchain-openai before 1.1.9
Timeline
- 2026-02-11: disclosed: GHSA-2g6r-c272-w58r published
- 2026-02-11: patched: langchain-openai 1.1.9 and langchain-core 1.2.11 released