LangChain is a framework for building agents and LLM-powered applications

In langchain-text-splitters versions before 1.1.2, HTMLHeaderTextSplitter.split_text_from_url() validates the *initial* URL, then fetches it with redirect following enabled. An attacker can submit a public URL they control, return a 302 to localhost, RFC1918 space, or headerless metadata endpoints, and make the application perform a server-side fetch that the original validation was supposed to block.

The vendor's 6.5 / MEDIUM is technically fair in a vacuum, but it overstates the enterprise-wide patch urgency. This is a library helper flaw in one specific method, not a product-wide pre-auth takeover: exploitation requires an application feature that accepts attacker-supplied URLs, meaningful impact usually requires the app to expose the fetched Document content back to the requester, and several major cloud metadata services are blunted by required headers.

Why this verdict

• Vendor baseline starts at 6.5, but reachability is narrow: this is not every LangChain app; it is apps that specifically call HTMLHeaderTextSplitter.split_text_from_url() with attacker influence.
• Downward adjustment for attacker position reality: the attacker is unauthenticated *only if* the application already offers a user-controlled URL ingestion feature. In most enterprises, that is a niche workflow, not a ubiquitous exposed surface.
• Downward adjustment for impact dependency: meaningful exfiltration often requires the application to return the fetched Document content or derivatives to the attacker. SSRF without observable output is much less valuable.
• Downward adjustment for cloud hardening: the advisory explicitly notes services requiring special headers — including IMDSv2/GCP/Azure metadata patterns — are not reachable through this bug, shrinking the common 'easy credential theft' path.
• Kept above IGNORE because the control bypass is real: it defeats an explicit SSRF guard and can still hit localhost, RFC1918 services, and AWS IMDSv1 where those are reachable.

Why not higher?

There is no product-wide internet-exposed endpoint here, no built-in auth bypass, and no direct RCE or integrity impact. Every important step after package presence depends on local application design choices: user-controlled URL input, outbound access, a useful internal target, and some path for the attacker to see the content.

Why not lower?

This is still a real SSRF protection bypass, not a theoretical code smell. If you have a public-facing ingestion endpoint using this helper, the attacker can coerce server-side fetches to sensitive internal locations and may recover useful data, so writing it off entirely would be sloppy.

1. Find the call sites — Code-search for split_text_from_url( and inventory every app path that can pass untrusted URLs into it. For a LOW verdict there is no SLA (treat as backlog hygiene), but you still want this mapped during the next dependency review because reachability decides everything.
2. Block attacker-controlled URL ingestion — If the feature is internet-facing, stop accepting arbitrary URLs or move fetching to a tightly controlled allowlist/proxy model. For LOW, there is no formal mitigation deadline, so fold this into normal hardening work rather than an emergency change.
3. Enforce outbound egress policy — Deny app hosts from reaching 127.0.0.0/8, RFC1918 ranges they do not need, and 169.254.169.254 unless there is a documented requirement. This reduces SSRF blast radius regardless of package version and belongs in standard platform guardrails.
4. Disable or strip redirects in wrappers — If you cannot patch quickly, wrap URL fetches so redirects are disabled or every redirect target is revalidated before follow. Treat that as normal engineering backlog for a LOW issue unless your own exposure review shows an internet-facing reachable path.
5. Stop echoing fetched content to requesters — Do not return raw fetched documents, summaries, or chunk previews from untrusted URL ingestion without a security review. That breaks the exfiltration leg of the chain even if the SSRF fetch still happens.

Run this inside the same Python environment as the target application — on the host, in the container, or in CI against the built image. Invoke it with python3 verify_cve_2026_41481.py; it needs no elevated privileges and checks installed package versions for langchain-text-splitters and langchain-core.

#!/usr/bin/env python3
"""
Verify exposure to CVE-2026-41481 in langchain-text-splitters.
Outputs one of: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
"""

from __future__ import annotations
import sys
from importlib import metadata


def parse_version(v: str):
    parts = []
    for token in v.replace('-', '.').split('.'):
        num = ''
        for ch in token:
            if ch.isdigit():
                num += ch
            else:
                break
        parts.append(int(num) if num else 0)
    return tuple(parts)


def get_version(dist_name: str):
    try:
        return metadata.version(dist_name)
    except metadata.PackageNotFoundError:
        return None
    except Exception:
        return 'ERROR'


def main() -> int:
    splitters = get_version('langchain-text-splitters')
    core = get_version('langchain-core')

    if splitters is None:
        print('UNKNOWN: langchain-text-splitters is not installed in this Python environment')
        return 2
    if splitters == 'ERROR':
        print('UNKNOWN: failed to read langchain-text-splitters package metadata')
        return 2

    if parse_version(splitters) < parse_version('1.1.2'):
        print(f'VULNERABLE: langchain-text-splitters {splitters} < 1.1.2')
        return 1

    if core is None:
        print(f'UNKNOWN: langchain-text-splitters {splitters} is >= 1.1.2 but langchain-core is not installed/readable')
        return 2
    if core == 'ERROR':
        print(f'UNKNOWN: langchain-text-splitters {splitters} is >= 1.1.2 but langchain-core metadata could not be read')
        return 2

    if parse_version(core) < parse_version('1.2.31'):
        print(f'UNKNOWN: langchain-text-splitters {splitters} is >= 1.1.2 but langchain-core {core} < 1.2.31 (advisory says patched line requires >= 1.2.31)')
        return 2

    print(f'PATCHED: langchain-text-splitters {splitters} and langchain-core {core} satisfy advisory minimums')
    return 0


if __name__ == '__main__':
    sys.exit(main())

Sources

1. NVD CVE-2026-41481
2. GitHub Security Advisory GHSA-fv5p-p927-qmxr
3. LangChain repository security advisories
4. GitLab Advisory Database entry
5. PyPI package: langchain-text-splitters
6. PyPI Stats for langchain-text-splitters
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS project / data documentation