The vulnerability exists in langchain_community/document_loaders/sitemap.py within the SitemapLoader.parse_sitemap method. While restrict_to_same_domain is intended to limit outbound requests to the same domain, it is only enforced on leaf URL entries. Nested sitemap elements bypass this restriction and are passed directly to the scrape_all method, which performs an aiohttp GET request without verifying the domain or blocking private, loopback, or link-local addresses. Consequently, an attacker who can supply or influence a nested sitemap URL can induce the server to fetch internal network resources. The content retrieved from these internal requests is parsed and included in the returned Documents, resulting in disclosure of internal responses to the attacker. This SSRF vulnerability has a CVSS 3.1 score of 8.6, indicating high severity. The affected versions are langchain-community <=0.4.2. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An attacker who controls or influences an ingested sitemap can exploit this vulnerability to make the server perform HTTP GET requests to internal or private network addresses that are normally inaccessible externally. The server will parse and return the fetched internal content to the attacker, leading to disclosure of potentially sensitive internal information. This bypasses the intended restrict_to_same_domain control, which was meant to confine outbound requests to the same domain. There is no indication that the vulnerability allows modification or disruption of internal resources, only information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid ingesting sitemaps from untrusted or attacker-controlled sources. Consider implementing additional network-level controls to restrict outbound HTTP requests from the application server to trusted domains only. Monitor for updates from the langchain-ai project regarding patches or official mitigations.