LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messagesGHSA-2g6r-c272-w58r
LOWFix: langchain-ai/langchain@2b4b1dcGHSA-2g6r-c272-w58r is a low-severity (CVSS 3.7) Server-Side Request Forgery (SSRF) vulnerability in langchain-core. A fix is available for langchain-core — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-2g6r-c272-w58r.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
langchain-coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Server-Side Request Forgery (SSRF) in ChatOpenAI Image Token Counting
Summary
The ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input.
Severity
Low - The vulnerability allows SSRF attacks but has limited impact due to:
- Responses are not returned to the attacker (blind SSRF)
- Default 5-second timeout limits resource exhaustion
- Non-image responses fail at PIL image parsing
Impact
An attacker who can control image URLs passed to get_num_tokens_from_messages() can:
- Trigger HTTP requests from the application server to arbitrary internal or external URLs
- Cause the server to access internal network resources (private IPs, cloud metadata endpoints)
- Cause minor resource consumption through image downloads (bounded by timeout)
Note: This vulnerability occurs during token counting, which may happen outside of model invocation (e.g., in logging, metrics, or token budgeting flows).
Details
The vulnerable code path:
get_num_tokens_from_messages()processes messages containingimage_urlcontent blocks- For images without
detail: "low", it calls_url_to_size()to fetch the image and compute token counts _url_to_size()performshttpx.get(image_source)on any URL without validation- Prior to the patch, there was no SSRF protection, size limits, or explicit timeout
File: libs/partners/openai/langchain_openai/chat_models/base.py
Patches
The vulnerability has been patched in langchain-openai==1.1.9 (requires langchain-core==1.2.11).
The patch adds:
- SSRF validation using
langchain_core._security._ssrf_protection.validate_safe_url()to block:- Private IP ranges (RFC 1918, loopback, link-local)
- Cloud metadata endpoints (169.254.169.254, etc.)
- Invalid URL schemes
- Explicit size limits (50 MB maximum, matching OpenAI's payload limit)
- Explicit timeout (5 seconds, same as
httpx.getdefault) - Allow disabling image fetching via
allow_fetching_images=Falseparameter
Workarounds
If you cannot upgrade immediately:
- Sanitize input: Validate and filter
image_urlvalues before passing messages to token counting or model invocation - Use network controls: Implement egress filtering to prevent outbound requests to private IPs
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | langchain-core | all versions | 1.2.11pip install --upgrade 'langchain-core==1.2.11' |
Affected Products
langchain corelangchainDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langchain-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update langchain-core to 1.2.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2g6r-c272-w58r is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
To exploit this issue, an attacker needs to be able to provide a malicious image_url to a LangChain instance. However, the server responses are not returned to the attacker (blind SSRF), increasing the complexity of exploitation. Additionally, an attacker can cause the server to fetch large files, potentially…
To mitigate this issue, manually validate that all image_url fields use the HTTP/HTTPS protocols, point to allowed public domains and do not resolve to internal IP addresses before passing messages to ChatOpenAI or any LangChain model.Source: Red Hat security advisory for GHSA-2g6r-c272-w58r (CC BY 4.0)
Frequently Asked Questions
Is GHSA-2g6r-c272-w58r in your dependencies?
Find it across PyPI, including transitive dependencies.