The vulnerability exists in the HTMLHeaderTextSplitter.split_text_from_url() function of langchain-text-splitters before version 1.1.2. Although the initial URL is validated with validate_safe_url(), the HTTP fetch uses requests.get() with redirects enabled by default, and redirect targets are not revalidated. This allows an attacker-controlled URL to redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The fetched response body is parsed into Document objects and returned to the application. If the application exposes these Document contents back to the requester, sensitive internal data could be leaked. Applications that do not expose raw Document content to the requester are not directly vulnerable to data exfiltration via this issue. The vulnerability is addressed in langchain-text-splitters version 1.1.2.

An attacker can exploit this SSRF vulnerability to cause the application to make HTTP requests to internal or cloud metadata endpoints by leveraging unvalidated redirects. This can lead to unauthorized disclosure of sensitive internal information if the application returns the fetched Document content to the requester. There is no indication of integrity or availability impact. The severity is rated medium with a CVSS score of 6.5.

This vulnerability is fixed in langchain-text-splitters version 1.1.2. Users should upgrade to version 1.1.2 or later to remediate the issue. No other official remediation level or temporary fix is indicated. Applications that do not expose Document contents back to requesters are not directly exposed to data exfiltration from this vulnerability.