49 matches found
CVE-2026-41481
LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.splittextfromurl validated the initial URL using validatesafeurl but then performed the fetch with requests.get with redirects enabled the default. Because...
langchain-text-splitters 代码问题漏洞
langchain-text-splitters is a Python package open-sourced by LangChain. Versions of langchain-text-splitters prior to 1.1.2 had code vulnerabilities. These vulnerabilities stemmed from the use of the splittextfromurl method in HTMLHeaderTextSplitter, which initiated a redirection after verifying...
CVE-2026-41481: Server-Side Request Forgery (SSRF)
LangChain is a framework for building agents and LLM-powered applications. Prior to langchain-text-splitters 1.1.2, HTMLHeaderTextSplitter.splittextfromurl validated the initial URL using validatesafeurl but then performed the fetch with requests.get with redirects enabled the default. Because...
LangChain Text Splitters: HTMLHeaderTextSplitter.split_text_from_url SSRF Redirect Bypass
Summary HTMLHeaderTextSplitter.splittextfromurl validated the initial URL using validatesafeurl but then performed the fetch with requests.get with redirects enabled the default. Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to...
actscene-ocr (>=0.1.3, <=0.1.5), biomni-bridge (>=0.3.1, <=0.3.3) +6 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.9)
langchain-text-splitters PYPI version 0.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - actscene-ocr =0.1.3, =0.3.1, =0.1.0, =1.0.25122300, =1.0.0, =0.1.0, =0.1.1 - structured-sql-agent 0.1.0 Source...
rs-docs-loader (>=0.0.7, <=0.1.1) potentially affected by CVE-2026-41481 via langchain-text-splitters (0.2.0)
langchain-text-splitters PYPI version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - rs-docs-loader =0.0.7, =0.1.1 Source cves: CVE-2026-41481 Source advisory: OSV:GHSA-FV5P-P927-QMXR...
actbench (0.0.1a5), agentic-kit-eda (0.0.2) +16 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.7)
langchain-text-splitters PYPI version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - actbench 0.0.1a5 - agentic-kit-eda 0.0.2 - agentic-kit-flow 0.0.1 - blastai =0.1.2, =0.1.41, =0.2.0, =0.3.0,...
agential (>=0.0.4, <=0.2.1), ai-review-assistant (>=0.1.0, <=0.4.0) +229 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.2.4)
langchain-text-splitters PYPI version 0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - agential =0.0.4, =0.1.0, =0.1.0, =0.0.1, =0.1.3, =0.2.0, =0.0.1, =0.1.4, =0.4.13, =0.9.1 and more Source cves:...
agent-nexus-cli (>=0.1.0, <=0.1.31), agentiva (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-41481 via langchain-text-splitters (>=1.0.0a1, <=1.1.1)
langchain-text-splitters PYPI version =1.0.0a1, =0.1.0, =0.1.0, =3.0.3, =3.1.0, =6.4.21, =0.1.0, =0.1.0, =0.4.0, =0.0.4, =0.8.0, =0.8.15 and more Source cves: CVE-2026-41481 Source advisory: GHSA-FV5P-P927-QMXR...
ai-enterprise-agent (>=0.0.2, <=0.0.9), data-digitization (0.1.0) +20 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.0.1)
langchain-text-splitters PYPI version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - ai-enterprise-agent =0.0.2, =0.1.14, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =0.1.3, =0.0.15, =1.0.6, =0.1.0b0, =0.5.0b1...
commit-crafter-ai (>=1.0.1, <=1.0.3), cori-ai (>=0.0.0, <=1.2.12) potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.3)
langchain-text-splitters PYPI version 0.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - commit-crafter-ai =1.0.1, =0.0.0, =1.2.12 Source cves: CVE-2026-41481 Source advisory: OSV:GHSA-FV5P-P927-QMXR...
aa-rag (>=0.1.0, <=0.4.1), aiagents4pharma (>=1.8.2, <=1.22.3) +10 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.5)
langchain-text-splitters PYPI version 0.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - aa-rag =0.1.0, =1.8.2, =1.0.0, =0.0.3, =0.0.2, =25.7.1.0, =0.3.0, =0.7.0, =0.1.1, =0.6.51, =0.0.30, =0.0.33 Sour...
agent-nexus-cli (>=0.1.0, <=0.1.31), agentiva (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-41481 via langchain-text-splitters (>=1.0.0a1, <=1.1.1)
langchain-text-splitters PYPI version =1.0.0a1, =0.1.0, =0.1.0, =3.0.3, =3.1.0, =6.4.21, =0.1.0, =0.1.0, =0.4.0, =0.0.4, =0.8.0, =0.8.15 and more Source cves: CVE-2026-41481 Source advisory: SNYK:PYTHON-LANGCHAINTEXTSPLITTERS-16095053...
agent-nexus-cli (>=0.1.0, <=0.1.31), agentiva (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-41481 via langchain-text-splitters (>=1.0.0a1, <=1.1.1)
langchain-text-splitters PYPI version =1.0.0a1, =0.1.0, =0.1.0, =3.0.3, =3.1.0, =6.4.21, =0.1.0, =0.1.0, =0.4.0, =0.0.4, =0.8.0, =0.8.15 and more Source cves: CVE-2026-41481 Source advisory: OSV:GHSA-FV5P-P927-QMXR...
a2a-client-handler (0.1.0), aa-rag (>=0.4.2, <=0.4.3) +106 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.8)
langchain-text-splitters PYPI version 0.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - a2a-client-handler 0.1.0 - aa-rag =0.4.2, =0.1.3, =0.5.18, =0.1.3, =0.0.45, =0.1.1, =0.0.1, =0.0.1, =0.0.4 and...
agentiacap (>=0.1.31, <=0.1.37), ai-parrot (>=0.5.0, <=0.5.17) +15 more potentially affected by CVE-2026-41481 via langchain-text-splitters (0.3.6)
langchain-text-splitters PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-text-splitters and may be impacted: - agentiacap =0.1.31, =0.5.0, =0.0.0, =0.3.1, =1.0.0, =1.1.2, =0.1.0, =0.1.0, =0.0.18, =0.2.1, =0.1.1, =0.1.13 and...
Server-side Request Forgery (SSRF)
Overview langchain-text-splitters is a LangChain text splitting utilities Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the splittextfromurl function. An attacker can access internal network resources and potentially exfiltrate sensitive data by supplying...
PT-2026-35311
Summary HTMLHeaderTextSplitter.split text from url validated the initial URL using validate safe url but then performed the fetch with requests.get with redirects enabled the default. Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to...
