CVE-2026-72848 langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...

CVE-2026-72848

CVE-2026-72848 is a Server-Side Request Forgery (SSRF) in langchain_community 's SitemapLoader.parse_sitemap (document_loaders/sitemap.py). The restrict_to_same_domain guard is applied only to leaf URL entries; nested sitemap index entries bypass it entirely, passing the child loc directly to Web...

PT-2026-79263

Name of the Vulnerable Software and Affected Versions langchain-community affected versions not specified Description The SitemapLoader.parse sitemap function in langchain community/document loaders/sitemap.py fails to apply the restrict to same domain control to nested sitemap entries. While lea...