← Back

CVE-2026-26013

nvd nist
Published: Feb 10, 2026Modified: Jun 17, 2026

JSON object

Loading...
3.7
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 2.2 / Impact: 1.4
Source: security-advisories@github.com (Secondary)

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.

Affected (1)

Langchain
1 product
Langchain Core
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Langchain Core
Before 1.2.11

Related CWEs

CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
MitigationVendor Advisory

Timeline

No history available yet.