CVE-2024-0243
Description
With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resolved in https://github.com/langchain-ai/langchain/pull/15559
How to fix
- langchain langchain0.1.0 or later
- langchain0.1.0 or later
- langchain-exa0.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| langchain langchain | v < 0.1.0 | 0.1.0 |
| langchainPyPI | v < 0.1.0 | 0.1.0 |
| langchain-exaPyPI | v < 0.1.0 | 0.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.