LangChainGHSA-h5gc-rm8j-5gpr
LangChain Community SSRF vulnerability exists in RequestsToolkit component
High8.4CVE-2025-2828 · Published Jun 23, 2025 · updated Jul 17, 2025
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| langchain-community PyPI | < 0.0.28 | 0.0.28 |
Details and references
A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result, an attacker could exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. This issue has been fixed in version 0.0.28.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-918
- Also known as
- CVE-2025-2828, PYSEC-2025-70
- nvd.nist.gov/vuln/detail/CVE-2025-2828
- github.com/langchain-ai/langchain/commit/e188d4ecb085d4561a0be3c583d26aa9c2c3283f
- github.com/langchain-ai/langchain-community
- github.com/pypa/advisory-database/tree/main/vulns/langchain-community/PYSEC-2025-70.yaml
- huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc
More LangChain advisories
All LangChain| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 42025 | Langchain Community Vulnerable to XML External Entity (XXE) Attacks CVE-2025-6984High7.5fixed in 0.3.27 | High7.5 | 0.3.27 |
| Mar 202025 | langchain-core allows unauthorized users to read arbitrary files from the host file system CVE-2024-10940Medium5.3fixed in 0.1.53, 0.2.43, 0.3.15 | Medium5.3 | 0.1.53, 0.2.43, 0.3.15 |
| Nov 202025 | LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates CVE-2025-65106Highfixed in 0.3.80, 1.0.7 | High | 0.3.80, 1.0.7 |
| Dec 232025 | LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs CVE-2025-68664Critical9.3fixed in 0.3.81, 1.2.5 | Critical9.3 | 0.3.81, 1.2.5 |
| Dec 232025 | LangChain serialization injection vulnerability enables secret extraction CVE-2025-68665High8.6fixed in 0.3.37, 0.3.80, 1.1.8, 1.2.3 | High8.6 | 0.3.37, 0.3.80, 1.1.8, 1.2.3 |
| Feb 11 | LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages CVE-2026-26013Low3.7fixed in 1.2.11 | Low3.7 | 1.2.11 |