CVE-2024-0243 is a high severity (CVSS 8.1) server side request forgery in LangChain's RecursiveUrlLoader. A crawled site could point to other domains and the crawler would fetch them even with prevent_outside set to True. The fix is in the LangChain 0.1.0 line, so upgrade.
What's affected
The record names the langchain product and gives no version range. Its description shows a RecursiveUrlLoader crawl with prevent_outside left at its default of True. A person who controls the crawled site could place links to other hosts, such as the record's example of example.completely.different, and the crawler would download them anyway.
The fix is in a pull request titled to further restrict the recursive URL loader (PR 15559), merged on 4 January 2024. The pull request page we fetched tags it as a patch to the core package, and says the change appears in the langchain 0.1.0 release notes. The record names the langchain product and the code link in the description points to the community package, so the package labels differ between sources. In practice check langchain, langchain-core and langchain-community, and confirm the fixed version in the release notes. We could not confirm an exact fixed version number for each package.
How to check if you're exposed
Look at what is installed:
pip show langchain langchain-core langchain-community
pip list | grep -i langchain
If you use a lock file, search it for the same names. Then search your code for the loader:
grep -rn "RecursiveUrlLoader" .
If the loader is not used, the exposure is limited. If it is used, list the start URLs. The risk depends on who controls the content you crawl. A crawler pointed at your own documentation site is a different case from one pointed at user supplied or third party sites. The free in-browser dependency scan can read a requirements file or lock file and match this advisory, and reachability analysis tells you whether the loader is called in your code, not just installed.
What to do now
- Find projects that install langchain, langchain-core or langchain-community and note their versions.
- Upgrade to a release that includes pull request 15559, which is part of the 0.1.0 line per its release notes.
- Search for RecursiveUrlLoader and list the start URLs it crawls.
- Run crawlers in a network segment that cannot reach internal services or cloud metadata endpoints.
- Add your own host allow list around any fetch that follows links.
Why it matters
The weakness class is CWE-918, server side request forgery. The crawler is meant to stay inside the starting site when prevent_outside is on. The record shows that links to a different host were followed anyway, so the restriction did not hold. Anything the crawler can reach, including internal addresses, becomes reachable through crafted content on the crawled page.
For retrieval pipelines this matters because crawled pages are untrusted input. A crawler that runs inside a corporate network can be pointed at internal services by content on an external site. The CVSS vector has high attack complexity, which reflects the need to control content on a crawled site, and high impact on confidentiality, integrity and availability.
The record's KEV flag is false and the pages we read do not claim exploitation. The upstream fix is small, so the cost of upgrading is low compared with the reach of a crawler on an internal network.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does setting prevent_outside protect me?
Not before the fix. The record says the crawler downloaded files from other hosts even with prevent_outside set to True.
Which package should I upgrade?
Check langchain, langchain-core and langchain-community. The sources label the package differently, so confirm in the release notes.
Sources
Last reviewed: 19 October 2026.
