CVE-2026-26019

CVE-2026-26019 affects the LangChain JS library (@langchain/community) before version 1.1.14, specifically the RecursiveUrlLoader. The cause is insufficient URL origin validation: it relied on String.startsWith() to compare URLs, failing to validate semantic origin and permitting crawling of atta...

CVE-2026-27795

CVE-2026-27795 concerns the LangChain JS community loader (RecursiveUrlLoader in @langchain/community). Prior to version 1.1.8, it could bypass SSRF protections by allowing automatic redirects after validating the initial URL, enabling a transition from a safe public URL to an internal/metadata e...