CVE-2026-41481

HTMLHeaderTextSplitter.split_text_from_url() validated the initial URL using validate_safe_url() but then performed the fetch with requests.get() with redirects enabled (the default). Because redirect targets were not revalidated, a URL pointing to an attacker-controlled server could redirect to internal, localhost, or cloud metadata endpoints, bypassing SSRF protections.

The response body is parsed and returned as Document objects to the calling application code. Whether this constitutes a data exfiltration path depends on the application: if it exposes Document contents (or derivatives) back to the requester who supplied the URL, sensitive data from internal endpoints could be leaked. Applications that store or process Documents internally without returning raw content to the requester are not directly exposed to data exfiltration through this issue.

Affected versions

• langchain-text-splitters < 1.1.2

Patched versions

• langchain-text-splitters >= 1.1.2 (requires langchain-core >= 1.2.31)

Affected code

File: libs/text-splitters/langchain_text_splitters/html.py, split_text_from_url()

The vulnerable pattern validated the URL once then fetched with redirects enabled:

validate_safe_url(url, allow_private=False, allow_http=True)
response = requests.get(url, timeout=timeout, **kwargs)

Attack scenario

1. A developer passes external URLs to split_text_from_url(), relying on its
   built-in validate_safe_url() check to block requests to internal networks.
2. An attacker supplies a URL pointing to a public host they control. The URL
   passes validate_safe_url() (public hostname, public IP).
3. The attacker's server responds with a 302 redirect to an internal endpoint
   (e.g., an unauthenticated internal admin API, or a cloud instance metadata
   service that does not require request headers, such as AWS IMDSv1).
4. requests.get() follows the redirect automatically. The redirect target is
   not revalidated.
5. The response body is parsed and returned as Document objects to the
   application.

Notes:

• The core issue is a bypass of an explicitly provided SSRF protection.
  split_text_from_url() included validate_safe_url() specifically to be
  safe with untrusted URLs, the redirect loophole defeated that guarantee.
• Cloud metadata endpoints that require special headers (AWS IMDSv2, GCP, Azure)
  are not reachable through this bug because the attacker does not control
  request headers. AWS IMDSv1, which requires no headers, is reachable.
• Data exfiltration requires the application to return Document contents to the
  party that supplied the URL. The SSRF itself, forcing the server to issue a
  request to an internal endpoint, does not require this.

Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.

CVE-2026-41481 has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.1.2); upgrading removes the vulnerable code path.

Kodem intelligence

The fix replaces requests.get() with an SSRF-safe httpx transport (SSRFSafeSyncTransport from langchain-core) that validates DNS results and pins connections to validated IPs on every request, including redirect targets, eliminating redirect-based bypasses.

Additionally, split_text_from_url() has been deprecated. Users should fetch HTML content themselves and pass it to split_text() directly.

1. What is CVE-2026-41481? CVE-2026-41481 is a medium-severity server-side request forgery (SSRF) vulnerability in langchain-text-splitters (pip), affecting versions < 1.1.2. It is fixed in 1.1.2. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
2. How severe is CVE-2026-41481? CVE-2026-41481 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of langchain-text-splitters are affected by CVE-2026-41481? langchain-text-splitters (pip) versions < 1.1.2 is affected.
4. Is there a fix for CVE-2026-41481? Yes. CVE-2026-41481 is fixed in 1.1.2. Upgrade to this version or later.
5. Is CVE-2026-41481 exploitable, and should I be worried? Whether CVE-2026-41481 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-41481 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-41481? Upgrade langchain-text-splitters to 1.1.2 or later.