8.4

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-2828

CVE-2025-2828: LangChain Community SSRF vulnerability exists in RequestsToolkit component

A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. As a result, an attacker could exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. This issue has been fixed in version 0.0.28.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-2828

CVE-2025-2828:

8.4

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langchain-community	pip	< 0.0.27	0.0.28

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is a Server-Side Request Forgery (SSRF) in the RequestsToolkit component of the langchain-community package. The request-making tools (RequestsGetTool, RequestsPostTool, etc.) did not have any restrictions on the URLs they could be instructed to access. This allowed an attacker to potentially scan internal networks, access local services, or query cloud metadata endpoints.

The vulnerability was not in a single line of code but rather in the design of how these powerful tools were provided to the end-developer. They were insecure by default. The investigation of the patch e188d4ecb085d4561a0be3c583d26aa9c2c3283f reveals that the fix was to introduce a mandatory opt-in mechanism.

A check was added to the __init__ method of BaseRequestsTool, the parent class for all request tools. This check ensures that a developer must explicitly pass allow_dangerous_requests=True to instantiate any of these tools, preventing accidental insecure use.
Factory functions like RequestsToolkit.get_tools and the high-level load_tools function were modified to propagate this new security flag. Before the patch, these functions would create and return the request tools in their default, vulnerable state.

Therefore, the vulnerable functions are the ones responsible for creating and providing these insecurely configured tools to the end-user, as they were the entry points for introducing the SSRF risk into an application.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.