4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27795

CVE-2026-27795: LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

LangChain is a framework for building LLM-powered applications. Prior to version 1.1.8, a redirect-based Server-Side Request Forgery (SSRF) bypass exists in RecursiveUrlLoader in @langchain/community. The loader validates the initial URL but allows the underlying fetch to follow redirects automatically, which permits a transition from a safe public URL to an internal or metadata endpoint without revalidation. This is a bypass of the SSRF protections introduced in 1.1.14 (CVE-2026-26019). Users should upgrade to @langchain/community 1.1.18, which validates every redirect hop by disabling automatic redirects and re-validating Location targets before following them. In this version, automatic redirects are disabled (redirect: "manual"), each 3xx Location is resolved and validated with validateSafeUrl() before the next request, and a maximum redirect limit prevents infinite loops.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27795

CVE-2026-27795:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@langchain/community	npm	<= 1.1.17	1.1.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a Server-Side Request Forgery (SSRF) bypass, is located in the @langchain/community package, specifically within the RecursiveUrlLoader component. The root cause was that the loader's fetch operation would automatically follow HTTP redirects without re-validating the destination URL. This created a "check-then-act" flaw where an attacker could supply a valid public URL that, upon being fetched, would redirect the server to an internal or sensitive address like a cloud metadata service.

The analysis of the provided commits confirms this. Commit d5e3db0d01ab321ec70a875805b2f74aefdadf9d introduced initial SSRF protection by adding a validateSafeUrl function and applying it to the initial URL. However, it did not account for redirects.

The subsequent commit, 2812d2b2b9fd9343c4850e2ab906b8cf440975ee, directly patches the redirect vulnerability. The changes are concentrated in the RecursiveUrlLoader.fetchWithTimeout method. The patch modifies the fetch call to disable automatic redirects (redirect: "manual") and introduces a loop. Within this loop, each redirect URL, extracted from the Location header, is explicitly validated using validateSafeUrl before the next request is made. This ensures that all URLs in a redirect chain are checked for safety, effectively closing the SSRF bypass.

Vulnerable functions

RecursiveUrlLoader.fetchWithTimeout

libs/langchain-community/src/document_loaders/web/recursive_url.ts

The vulnerability existed in the `fetchWithTimeout` method within the `RecursiveUrlLoader` class. The original implementation used the `fetch` API with its default behavior of automatically following redirects (`redirect: 'follow'`). While the initial URL passed to the loader was validated, any subsequent URL from a 3xx redirect was not. An attacker could provide a safe initial URL that redirects to a protected internal or cloud metadata endpoint, bypassing the SSRF protections. The patch remediates this by setting `redirect: 'manual'` and implementing a loop to manually validate each redirect location before making a new request.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.