{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-29T04:32:00.240","vulnerabilities":[{"cve":{"id":"CVE-2026-26019","sourceIdentifier":"security-advisories@github.com","published":"2026-02-11T22:15:51.910","lastModified":"2026-02-19T19:25:25.940","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14."},{"lang":"es","value":"LangChain es un framework para construir aplicaciones impulsadas por LLM. Antes de la versión 1.1.14, la clase RecursiveUrlLoader en @langchain/community es un rastreador web que sigue enlaces recursivamente desde una URL inicial. Su opción preventOutside (habilitada por defecto) está destinada a restringir el rastreo al mismo sitio que la URL base. La implementación utilizaba String.startsWith() para comparar URLs, lo que no realiza una validación semántica de URL. Un atacante que controla contenido en una página rastreada podría incluir enlaces a dominios que comparten un prefijo de cadena con el objetivo, haciendo que el rastreador siga enlaces a infraestructura controlada por el atacante o interna. Además, el rastreador no realizaba ninguna validación contra direcciones IP privadas o reservadas. Una página rastreada podría incluir enlaces dirigidos a servicios de metadatos en la nube, localhost o direcciones RFC 1918, y el rastreador los obtendría sin restricción. Esta vulnerabilidad está corregida en la versión 1.1.14."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:langchain:langchain_community:*:*:*:*:*:node.js:*:*","versionEndExcluding":"1.1.14","matchCriteriaId":"44439283-CF4F-44F1-B029-8A83E327DC2C"}]}]}],"references":[{"url":"https://github.com/langchain-ai/langchainjs/commit/d5e3db0d01ab321ec70a875805b2f74aefdadf9d","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/langchain-ai/langchainjs/pull/9990","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/langchain-ai/langchainjs/releases/tag/%40langchain%2Fcommunity%401.1.14","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/langchain-ai/langchainjs/security/advisories/GHSA-gf3v-fwqg-4vh7","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}}]}