Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The langchain-community package is vulnerable to server-side request forgery in its RequestsToolkit component (langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in versions before 0.0.28. The toolkit does not restrict requests to local addresses, so an attacker who can get it to make requests could port scan, reach local services, read cloud instance metadata, and interact with servers on the local network. Upgrade to langchain-community 0.0.28 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.4 | High | 3.0 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | CNA (@huntr_ai) |
- CISA KEV Not listed.
- EPSS 0.21, the 97th percentile, on 15 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.