Skip to content
AgentProv

2026-04-24 · 2026-Q2

LangChain langchain-openai and langchain-text-splitters SSRF Disclosures

Primary layerL8 Output / Destination

Where is this data going, and who chose that?

The question layer 8 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

LangChain langchain-openai (before 1.1.14) and langchain-text-splitters (before 1.1.2)

Impact

Attacker-controlled URLs can reach private and localhost services (cloud metadata, internal admin interfaces) from any host running LangChain image-token counting or HTML splitter helpers

Root cause

TOCTOU and DNS rebinding window in `_url_to_size()` (validate-then-fetch pattern with independent DNS resolution); HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL but followed redirects via `requests.get()` without revalidating redirect targets

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: LangChain langchain-openai and langchain-text-splitters SSRF Disclosures (2026-04-24). https://agentprov.com/incidents/2026-04-24-langchain-langchain-openai-and-langchain-text-splitters-ssrf-disclosures

Related