Executive brief
LangChain Community's SitemapLoader component is used to automatically fetch and parse website sitemaps. A vulnerability allows attackers who control a sitemap to bypass the domain-restriction security control and force the application to make HTTP requests to internal or private network addresses, disclosing the content of responses that should have been blocked.
Technical details
The vulnerability is a security control bypass in SitemapLoader.parse_sitemap within langchain_community/document_loaders/sitemap.py. While the restrict_to_same_domain parameter filters cross-domain URLs in the main loop, nested sitemap references (child loc elements) bypass this check and pass URLs directly to WebBaseLoader.scrape_all via aiohttp GET requests without domain validation. An attacker controlling an ingested sitemap can point nested sitemap entries to internal addresses (private IPs, loopback, link-local), causing the server to fetch and parse them regardless of the restrict_to_same_domain setting. The fetched content is parsed and returned in Documents, disclosing internal responses to the caller. No authentication is required; the attack requires only the ability to influence the sitemap content.
Affected products
- LangChain langchain-community
Timeline
- 2026-08-20: disclosed