CVE-2026-72848: Server-Side Request Forgery (SSRF) in langchain-ai langchain-community
Description
SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no domain comparison and no check for private, loopback or link-local destinations. An attacker who controls or influences an ingested sitemap can therefore point a nested sitemap entry at an internal address and make the server fetch it even when the deploying application set restrict_to_same_domain to True specifically to confine outbound requests. The fetched content is parsed and surfaces in the returned Documents, so internal responses are disclosed to the caller rather than merely requested.
CVSS v3.1
Score 8.6high
Affected software
langchain-ai
langchain-community
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py, where the restrict_to_same_domain control is only applied to leaf URL entries. Nested sitemap elements are passed directly to a scraping function that performs an aiohttp GET request without verifying the domain or checking for private, loopback, or link-local addresses. An attacker controlling or influencing the ingested sitemap can exploit this to make the server fetch internal addresses, causing internal content to be disclosed in the returned documents.
Potential Impact
An attacker can cause the vulnerable server to make HTTP requests to internal network resources or other restricted addresses, potentially disclosing sensitive internal information in the response documents. This bypasses the intended domain restriction controls and can lead to information leakage from internal systems.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid ingesting untrusted sitemaps or implement additional network-level controls to restrict outbound HTTP requests from the application to trusted domains only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T15:14:51.468Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a877ac9acd9273b49302630
Added to database: 08/20/2026, 22:08:09 UTC
Last enriched: 10/02/2026, 15:51:23 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.