langchain-ai Vulnerabilities and Affected Products
Vulnerabilities associated with langchain-text-splitters.
Products
Clear product- langchain-ai/langchain12 vulnerabilities
- langchain9 vulnerabilities
- langgraph7 vulnerabilities
- langsmith-sdk5 vulnerabilities
- langchainjs4 vulnerabilities
- langchain-ai/langchainjs2 vulnerabilities
- langchain-ai\/langchain2 vulnerabilities
- langgraphjs2 vulnerabilities
- helm1 vulnerability
- langchain-ai1 vulnerability
- langchain-ai\/langchainjs1 vulnerability
- langchain-anthropic1 vulnerability
- langchain-openai1 vulnerability
- langchain-sdk1 vulnerability
- langchain-text-splitters1 vulnerability
- langgraph-checkpoint1 vulnerability
- langgraph-checkpoint-postgres1 vulnerability
- langgraph-checkpoint-sqlite1 vulnerability
- langraph-checkpoint1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-41481MEDIUM | LangChain: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect BypassLangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections. The resp… CWE-918Apr 24, 2026 | CVSS6.5v3.1 | EPSS0.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |