Executive brief
LangChain Community's RecursiveUrlLoader is a web crawling component used to automatically fetch and process content from websites. An attacker can exploit a flaw in redirect handling to make the crawler access internal services, cloud metadata endpoints, or localhost—bypassing the existing security protections. This could expose sensitive credentials, tokens, or data from internal infrastructure that the crawler has access to.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in RecursiveUrlLoader that exploits automatic redirect following. The component validates the initial URL against a blocklist (private IPs, cloud metadata endpoints) but does not re-validate when HTTP 3xx redirects are followed. An attacker can supply a URL that passes initial validation, which then redirects to a blocked destination (e.g., 169.254.169.254 for AWS metadata), and the underlying fetch() call follows the redirect without triggering the SSRF checks. This is a "check-then-act" gap: validation occurs before redirect resolution. The fix disables automatic redirects (redirect: "manual"), manually validates each Location header before following it, and enforces a maximum redirect limit. Affected versions: @langchain/community <= 1.1.17; patched in 1.1.18.
Affected products
- LangChain @langchain/community < 1.1.18
Timeline
- 2026-02-25: disclosed
- 2026-02-25: patched: Version 1.1.18 released with fix