CVE-2025-2828

Advisory

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of proper URL validation in the RequestsToolkit component. The RequestsToolkit fails to enforce restrictions on target URLs, allowing requests to both remote internet addresses and local network addresses, leading to potential port scanning, access to local services, retrieval of cloud instance metadata, and interaction with internal network resources.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-h5gc-rm8j-5gpr
• https://github.com/langchain-ai/langchain/commit/e188d4ecb085d4561a0be3c583d26aa9c2c3283f
• https://huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2828