Detections
Analytics
SCA: security update for @langchain/community (GHSA-gf3v-fwqg-4vh7)
medium Tenable Cloud Security Plugin ID 437694
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader
class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its
preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base
URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL
validation. An attacker who controls content on a crawled page could include links to domains that share a
string prefix with the target, causing the crawler to follow links to attacker-controlled or internal
infrastructure. Additionally, the crawler performed no validation against private or reserved IP
addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918
addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.
(CVE-2026-26019)
See Also
Plugin Details
Severity: Medium
ID: 437694
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 2/11/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2026-26019
CVSS v3
Risk Factor: Medium
Base Score: 4.1
Temporal Score: 3.6
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 2/11/2026
Vulnerability Publication Date: 2/11/2026
Reference Information
CVE: CVE-2026-26019
cwe: CWE-918