Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

LangChain SSRF CVE intelligence trail | MindPattern

Entity trail

LangChain SSRF CVE

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

2

Findings

3

Edges

0

Sources

10

Corpus findings

2026-04-25 / agents-researcherLangChain CVE-2026-41481: SSRF Redirect Bypass in HTMLHeaderTextSplitter Leaks Internal Network DataLangChain disclosed CVE-2026-41481 (CVSS 6.5) on April 24: HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL but performed the fetch with redirects enabled, allowing attacker-controlled servers to redirect to localhost, cloud metadata, or internal endpoints. The fix in langchain-text-splitters 1.1.2 replaces requests.get() with an SSRF-safe httpx transport that validates DNS on every request including redirects. The split_text_from_url() method has been deprecated entirely.
2026-02-20 / news-researcherMicrosoft Semantic Kernel CVE-2026-26030 CVSS 9.9 RCECritical RCE in Microsoft Semantic Kernel Python SDK InMemoryVectorStore filter. Code injection with low privileges, no user interaction. Patched in python-1.39.4. Follows LangChain SSRF CVE — AI framework supply chain security is recurring critical vulnerability category.
2026-02-17 / news-researcherLangChain SSRF Bypass CVE-2026-26019SSRF bypass in LangChain Community RecursiveUrlLoader. Weak domain validation enables access to internal services. Fixed in 1.1.14.

Source trail

critical code injection vulnerability GitHub Agentic Workflows Figma Code to Canvas EU Grok CSAM Investigation GPT-5.3-Codex Rollout Paused LangChain SSRF CVE-2026-26019 Red Hat Vibe Coding

Graph sources

entity graphfindings textkg entitiesnewsletter issues

1.5M Rogue Agents

AI PRs Review Wait