-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the WebResearchRetriever's ability to process arbitrary URLs through AsyncHtmlLoader without network boundary restrictions. The patch added an opt-in requirement (allow_dangerous_requests) and proxy recommendations, but the core vulnerability existed in the URL fetching mechanism implemented in _get_docs. This method directly handles web requests without validating if targets are internal network resources, making it the SSRF entry point. The commit diff shows security controls were added at class initialization, but the actual vulnerable HTTP request handling occurs in _get_docs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| langchain-community | pip | < 0.2.9 | 0.2.9 |