—

PYSEC-2023-205

Quick fix

PYSEC-2023-205 — langchain: upgrade to the fixed version with the command below.

pip install --upgrade 'langchain>=9ecb7240a480720ec9d739b3877a52f76098a2b8'

Details

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/langchain

Introduced in: 0Fixed in: 9ecb7240a480720ec9d739b3877a52f76098a2b8

Fixpip install --upgrade 'langchain>=9ecb7240a480720ec9d739b3877a52f76098a2b8'

References

https://github.com/langchain-ai/langchain/commit/9ecb7240a480720ec9d739b3877a52f76098a2b8[FIX]
https://github.com/langchain-ai/langchain/pull/11925[WEB]
https://github.com/advisories/GHSA-655w-fm8m-m478[ADVISORY]