Executive brief
A vulnerability in the langchain-openai library could allow an attacker to bypass security protections and make the software connect to internal network services. This occurs when the library attempts to count tokens in an image by fetching it from a URL. While an attacker cannot steal data from these internal services, they could potentially use this flaw to map out internal network infrastructure or identify open ports on private servers.
Technical details
The `_url_to_size()` helper in `langchain_openai` (used for image token counting) implements a 'validate-then-fetch' pattern with separate DNS resolutions. This creates a Time-of-Check Time-of-Use (TOCTOU) window where an attacker-controlled hostname can resolve to a public IP during validation and a private/localhost IP during the actual fetch (DNS rebinding). While the fetched content is only passed to Pillow's `Image.open()` and not returned to the user, an attacker can perform blind SSRF to probe internal network availability. The vulnerability is fixed in version 1.1.14 by using an SSRF-safe transport that pins the connection to a validated IP and disables redirects.
Affected products
- LangChain AI langchain-openai < 1.1.14
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched