With the following crawler configuration:
```python
from bs4 import BeautifulSoup as Soup
url = "https://example.com"
loader = RecursiveUrlLoader(
url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text
)
docs = loader.load()
```
An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`.
https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51
Resolved in https://github.com/langchain-ai/langchain/pull/15559
References
| Link | Resource |
|---|---|
| https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22 | Patch |
| https://github.com/langchain-ai/langchain/pull/15559 | Issue Tracking Patch |
| https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22 | Patch |
| https://github.com/langchain-ai/langchain/pull/15559 | Issue Tracking Patch |
| https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
25 Feb 2025, 22:56
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CPE | cpe:2.3:a:langchain:langchain:*:*:*:*:*:*:*:* | |
| First Time |
Langchain langchain
Langchain |
|
| References | () https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22 - Patch | |
| References | () https://github.com/langchain-ai/langchain/pull/15559 - Issue Tracking, Patch | |
| References | () https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861 - Exploit, Issue Tracking, Third Party Advisory |
Information
Published : 2024-02-26 16:27
Updated : 2025-02-25 22:56
NVD link : CVE-2024-0243
Mitre link : CVE-2024-0243
CVE.ORG link : CVE-2024-0243
JSON object : View
Products Affected
langchain
- langchain
CWE
CWE-918
Server-Side Request Forgery (SSRF)