{"id":"CVE-2026-27795","aliases":["GHSA-mphv-75cg-56wg"],"url":"https://o3.security/vulnerability/CVE-2026-27795","summary":"LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader","details":"## Summary\nA redirect-based Server-Side Request Forgery (SSRF) bypass exists in `RecursiveUrlLoader` in `@langchain/community`. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019).\n\n## Affected Component\n- Package: `@langchain/community`\n- Component: `RecursiveUrlLoader`\n- Configuration: `preventOutside` (default: `true`) is insufficient to prevent this bypass when redirects are followed automatically.\n\n## Description\n`RecursiveUrlLoader` is a web crawler that recursively follows links from a starting URL. The existing SSRF mitigation validates the initial URL before fetching, but it does not re-validate when the request follows redirects. Because fetch follows redirects by default, an attacker can supply a public URL that passes validation and then redirects to a private network address, localhost, or cloud metadata endpoint.\n\nThis constitutes a “check‑then‑act” gap in the request lifecycle: the safety check occurs before the redirect chain is resolved, and the final destination is never validated.\n\n## Impact\nIf an attacker can influence content on a page being crawled (e.g., user‑generated content, untrusted external pages), they can cause the crawler to:\n- Fetch cloud instance metadata (AWS, GCP, Azure), potentially exposing credentials or tokens\n- Access internal services on private networks (`10.x`, `172.16.x`, `192.168.x`)\n- Connect to localhost services\n- Exfiltrate response data through attacker-controlled redirect chains\n\nThis is exploitable in any environment where `RecursiveUrlLoader` runs with access to internal networks or metadata services, which includes most cloud-hosted deployments.\n\n## Attack Scenario\n1. The crawler is pointed at a public URL that passes initial SSRF validation.\n2. That URL responds with a 3xx redirect to an internal target.\n3. The fetch follows the redirect automatically without revalidation.\n4. The crawler accesses the internal or metadata endpoint.\n\nExample redirector:\n```\nhttps://302.r3dir.me/--to/?url=http://169.254.169.254/latest/meta-data/\n```\n\n## Root Cause\n- SSRF validation (`validateSafeUrl`) is only performed on the initial URL.\n- Redirects are followed automatically by fetch (`redirect: \"follow\"` default), so the request can change destinations without additional validation.\n\n## Resolution\nUpgrade to `@langchain/community` **>= 1.1.18**, which validates every redirect hop by disabling automatic redirects and re-validating `Location` targets before following them.\n- Automatic redirects are disabled (`redirect: \"manual\"`).\n- Each 3xx `Location` is resolved and validated with `validateSafeUrl()` before the next request.\n- A maximum redirect limit prevents infinite loops.\n\n## Reources\n- Original SSRF fix (CVE-2026-26019): enforced origin comparison and added initial URL validation\n- https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7","published":"2026-02-25T17:30:01.106Z","modified":"2026-10-28T02:31:05.964088983Z","cvss":{"score":4.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@langchain/community","fixedVersion":"1.1.18"}],"fix":{"url":"https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee","label":"langchain-ai/langchainjs@2812d2b"},"references":[{"type":"WEB","url":"https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14"},{"type":"WEB","url":"https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27795.json"},{"type":"ADVISORY","url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7"},{"type":"ADVISORY","url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-mphv-75cg-56wg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27795"},{"type":"FIX","url":"https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee"},{"type":"FIX","url":"https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d"},{"type":"FIX","url":"https://github.com/langchain-ai/langchainjs/pull/9990"},{"type":"PACKAGE","url":"https://github.com/langchain-ai/langchainjs"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:31:05.964088983Z"}}