LangChain Server Side Request Forgery Vulnerability (CVE-2023-46229)
Summary
CVE-2023-46229: LangChain Server Side Request Forgery vulnerability. Affects langchain versions < 0.0.317. Fixed in 0.0.317. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LangChain is a Python package available on PyPI that provides functionality for crawling and processing data. It allows users to crawl websites and extract information for various purposes. However, LangChain versions before 0.0.317 are vulnerable to a Server Side Request Forgery (SSRF) vulnerability. SSRF allows an attacker to make requests from the server to other internal resources, potentially leading to unauthorized access or information disclosure.
Vulnerability Detail
The SSRF vulnerability in LangChain is present in the document_loaders/recursive_url_loader.py file. This vulnerability allows crawling to proceed from an external server to an internal server, bypassing any restrictions or security measures in place. An attacker can exploit this vulnerability to make requests to internal resources, potentially accessing sensitive information or performing actions on behalf of the server. The impact of this vulnerability can vary depending on the specific configuration and permissions of the targeted server.
How To Fix
Latest published version: 1.4.7 as of 22 Oct 2026
pip install --upgrade "langchain==1.4.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.0.317
This is the first release that contains the fix.
pip install --upgrade "langchain==0.0.317"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The LangChain Server Side Request Forgery vulnerability (CVE-2023-46229) allows an attacker to make unauthorized requests to internal resources, potentially leading to information disclosure or unauthorized actions. It is crucial for users of LangChain to upgrade to version 0.0.317 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for langchain →
FAQ
LangChain is a Python package that provides functionality for crawling and processing data from websites.
SSRF is a vulnerability that allows an attacker to make requests from the server to other internal resources, potentially leading to unauthorized access or information disclosure.
The SSRF vulnerability in LangChain allows an attacker to make requests to internal resources, potentially accessing sensitive information or performing actions on behalf of the server.
Yes, the SSRF vulnerability can be fixed by upgrading to version 0.0.317 or later of LangChain.
To update your LangChain installation, run the command 'pip install --upgrade langchain'. This will install the latest version of LangChain with the necessary fix for the SSRF vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for langchain.
