PyPI: langchain-community
CVE-2025-2828
Safety vulnerability ID: SFTY-20250623-57712
Safety legacy ID: pyup.io-77900
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of proper URL validation in the RequestsToolkit component. The RequestsToolkit fails to enforce restrictions on target URLs, allowing requests to both remote internet addresses and local network addresses, leading to potential port scanning, access to local services, retrieval of cloud instance metadata, and interaction with internal network resources.
Overview
LangChain Community SSRF vulnerability exists in RequestsToolkit component
Advisory
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of proper URL validation in the RequestsToolkit component. The RequestsToolkit fails to enforce restrictions on target URLs, allowing requests to both remote internet addresses and local network addresses, leading to potential port scanning, access to local services, retrieval of cloud instance metadata, and interaction with internal network resources.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20250623-57712/CVE-2025-2828
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2828
- https://github.com/advisories/GHSA-h5gc-rm8j-5gpr
- https://github.com/langchain-ai/langchain/commit/e188d4ecb085d4561a0be3c583d26aa9c2c3283f
- https://huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc
- https://nvd.nist.gov/vuln/detail/CVE-2025-2828
- https://github.com/langchain-ai/langchain/commit/e188d4ecb085d4561a0be3c583d26aa9c2c3283f
- https://huntr.com/bounties/8f771040-7f34-420a-b96b-5b93d4a99afc
- https://github.com/pypa/advisory-database/tree/main/vulns/langchain-community/PYSEC-2025-70.yaml
- https://github.com/advisories/GHSA-h5gc-rm8j-5gpr
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more