PyPI/langchain CVE-2024-0243: low 3.7, EPSS 0.52%

langchain Server-Side Request Forgery vulnerability

Action: Upgrade langchain to 0.1.0 or later.

pip install langchain==0.1.0

Affected

Fixed versions

Sources

• osv: GHSA-h9j7-5xvc-qhg5
• https://nvd.nist.gov/vuln/detail/CVE-2024-0243
• https://github.com/langchain-ai/langchain/pull/15559
• https://github.com/langchain-ai/langchain/commit/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22
• https://github.com/langchain-ai/langchain
• https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51
• https://github.com/pypa/advisory-database/tree/main/vulns/langchain-exa/PYSEC-2024-235.yaml
• https://huntr.com/bounties/370904e7-10ac-40a4-a8d4-e2d16e1ca861

CVE-2024-0243 · published 2024-02-26T18:30:29Z · modified 2026-07-07T17:56:41.991383859Z · JSON