4.1

CVE-2026-26019: langchain-ai langchainjs Server-Side Request Forgery (SSRF)

CVSS: 4.1v3.1MediumAnalyzed
AliasesGHSA-gf3v-fwqg-4vh7CGA-23g3-4j6g-r5hrCGA-3mx9-7w6c-2mgq
Published 11-02-2026Last modified 12-02-2026
Open JSON

Vulnerability summary

CVE-2026-26019 is a medium (CVSS 4.1) Server-Side Request Forgery (SSRF) vulnerability in langchain-ai langchainjs. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.9% of scored vulnerabilities.

Overall risk
16/100
0100
Low · default modelHow is this calculated?
CVSS score
4.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-RPPH-6G68-R735CVE-2026-27795

Timeline

  1. 11-02-2026
    PublishedVulnerability first disclosed.
  2. 12-02-2026
    Last modifiedVulnerability information updated.

Description

LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

32%

Versus all other CVEs

30-day change

+0.01 pp

From 0.39% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard14 products
  • kibana-8.17All versions (No fix recorded)
  • kibana-8.17-bitnamiAll versions (No fix recorded)
  • kibana-8.17-iamguardedAll versions (No fix recorded)
  • kibana-8.18All versions (No fix recorded)
  • kibana-8.18-bitnamiAll versions (No fix recorded)
@langchain1 product
  • community< 1.1.14
Langchain1 product
Langchain-ai1 product

4 vendors · 17 products

References

7 links