The flaw resides in the RecursiveUrlLoader class of the @langchain/community component of the langchainjs framework. The loader’s preventOutside option, meant to confine the crawler to the same origin as the start URL, relies on a trivial String.startsWith() check for origin validation. This does not account for URL semantics, and it also fails to reject URLs that resolve to private or reserved IP addresses. An attacker who controls content on a page that the crawler visits can embed links that share a string prefix with the base URL yet point to attacker‑controlled domains or to internal infrastructure such as cloud metadata services or localhost. The crawler follows those links, causing a Server Side Request Forgery that can expose confidential data or provide a foothold into the target network. The CVSS score of 4.1 indicates moderate severity.

langchain-ai’s langchainjs library includes the @langchain/community module with the RecursiveUrlLoader class. Versions older than 1.1.14 (1.1.13 and earlier) contain the SSRF bypass. Updated to 1.1.14 eliminates the flaw. The vulnerability affects applications built with Node.js that import @langchain/community and use RecursiveUrlLoader on URLs originating from or reachable through adversary-controlled content.

The vulnerability is a moderate‑severity SSRF flaw with a CVSS score of 4.1. The EPSS of less than 1% indicates a very low current likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack path involves an attacker hosting a web page that the application’s crawler processes; by embedding malicious or internal links, the crawler would issue requests to private networks, RFC 1918 addresses, localhost, or cloud metadata endpoints with no restriction. If the application uses the crawler on arbitrary URLs supplied by or reachable from an attacker, the SSRF could be triggered with minimal prerequisites and provide access to internal resources.