LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader
    class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its
    preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base
    URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL
    validation. An attacker who controls content on a crawled page could include links to domains that share a
    string prefix with the target, causing the crawler to follow links to attacker-controlled or internal
    infrastructure. Additionally, the crawler performed no validation against private or reserved IP
    addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918
    addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.
    (CVE-2026-26019)

ID	Name	Product	Family	Type	Severity
464716	Echo: @langchain/community: security update to 1.1.14	Tenable Cloud Security	Echo Local Security Checks	Local	medium
464716	Echo: @langchain/community: security update to 1.1.14	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
437694	SCA: security update for @langchain/community (GHSA-gf3v-fwqg-4vh7)	Tenable Cloud Security	SCA Checks	Local	medium
437694	SCA: security update for @langchain/community (GHSA-gf3v-fwqg-4vh7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-26019

medium

Tenable Plugins

medium

medium

medium

medium