CVE-2026-27795

npm/@langchain/community CVE-2026-27795: medium 4.1, EPSS 0.44%

LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader

Action: Upgrade @langchain/community to 1.1.18 or later.

npm i @langchain/community@1.1.18

Affected

Fixed versions

Sources

• osv: GHSA-mphv-75cg-56wg
• https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7
• https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-mphv-75cg-56wg
• https://nvd.nist.gov/vuln/detail/CVE-2026-27795
• https://github.com/langchain-ai/langchainjs/pull/9990
• https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee
• https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d
• https://github.com/langchain-ai/langchainjs
• https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14
• https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18

CVE-2026-27795 · published 2026-02-25T22:59:48Z · modified 2026-09-10T03:50:35.426033968Z · JSON