CVE-2024-0243

Katalog CVE

CVSS 8.1 · High EPSS 0,52%

Kerentanan Server-Side Request Forgery (SSRF) pada langchain. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resolved in https://github.com/langchain-ai/langchain/pull/15559

Rincian

Terbit di NVD

26 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22 patch
• https://github.com/langchain-ai/langchain/pull/15559 issue tracking · patch
• https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861 exploit · issue tracking · advisory pihak ketiga