Description
The RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL.
The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation.
Recommendation
Update the @langchain/community package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.1.13
- Patched version(s): 1.1.14
References
Could your website be exposed too?
SmartScanner can check your website for @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoader - CVE-2026-27795
- Feathers has an origin validation bypass via prefix matching - CVE-2026-27192
- Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass - CVE-2025-59845
- Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules - nitro - CVE-2026-44372
You might also like:
See something that needs correcting? Let us knowUpdated February 12, 2026