LangChain is a framework used to build agents and large‑language‑model powered applications. In versions prior to 1.2.11 the ChatOpenAI.get_num_tokens_from_messages() routine calculates token counts for vision‑enabled models by retrieving the image_url field of any supplied messages without performing validation. This flaw allows an attacker to supply a crafted image_url that points to any internal or external endpoint, enabling a Server‑Side Request Forgery attack. The vulnerability can be leveraged to request arbitrary resources from the host system, potentially exposing sensitive internal services or credentials, compromising both confidentiality and integrity.

The vulnerability affects the LangChain product from the vendor langchain‑ai. All releases before version 1.2.11 are impacted. Deployments that use older versions of the LangChain core library without applying the 1.2.11 patch are susceptible.

According to the CVSS score of 3.7, the severity is currently classified as low. The EPSS score of less than 1% indicates a very small probability of exploitation at this time, and the vulnerability is not part of the CISA KEV catalog. Nevertheless, the attack path is straightforward: an attacker who can supply arbitrary messages to the ChatOpenAI component can embed a malicious image_url. When the application computes token counts, the library will follow that URL, allowing the attacker to reach internal hosts or services. No special privileges or exploits are required beyond the ability to craft input to the affected function.