{"action":"Upgrade @langchain/community to 1.1.18 or later.","affected":[{"fixed":"1.1.18","introduced":"0"}],"component":"@langchain/community","cve_ids":["CVE-2026-27795"],"ecosystem":"npm","epss":0.00439,"exploited":false,"fixed_versions":["1.1.18"],"ghsa_id":"GHSA-mphv-75cg-56wg","id":"tcs_01M5KG1AH2KGHQ2XRW79M29PS3","modified_at":"2026-09-10T03:50:35.426033968Z","published_at":"2026-02-25T22:59:48Z","references":["https://osv.dev/vulnerability/GHSA-mphv-75cg-56wg","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7","https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-mphv-75cg-56wg","https://nvd.nist.gov/vuln/detail/CVE-2026-27795","https://github.com/langchain-ai/langchainjs/pull/9990","https://github.com/langchain-ai/langchainjs/commit/2812d2b2b9fd9343c4850e2ab906b8cf440975ee","https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d","https://github.com/langchain-ai/langchainjs","https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14","https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.18"],"severity":{"label":"medium","score":4.1},"sources":[{"source":"osv","source_id":"GHSA-mphv-75cg-56wg","url":"https://osv.dev/vulnerability/GHSA-mphv-75cg-56wg"}],"summary":"LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader"}