Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-7teg-apyx-47dv
Vulnerability ID VCID-7teg-apyx-47dv
Aliases CVE-2024-3095
GHSA-q25c-c977-4cmh
Summary Server-Side Request Forgery in langchain A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This flaw enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from cloud environments. The vulnerability is particularly concerning as it can be exploited to abuse the Web Explorer server as a proxy for web attacks on third parties and interact with servers in the local network, including reading their response data. This could potentially lead to arbitrary code execution, depending on the nature of the local services. The vulnerability is limited to GET requests, as POST requests are not possible, but the impact on confidentiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing interactions with internal APIs.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00163 https://api.first.org/data/v1/epss?cve=CVE-2024-3095
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-q25c-c977-4cmh
cvssv3.1 4.8 https://github.com/langchain-ai/langchain
generic_textual MODERATE https://github.com/langchain-ai/langchain
cvssv3.1 4.8 https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
generic_textual MODERATE https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
cvssv3.1 4.8 https://github.com/langchain-ai/langchain/pull/24451
generic_textual MODERATE https://github.com/langchain-ai/langchain/pull/24451
cvssv3.1 4.8 https://github.com/langchain-ai/langchain/releases/tag/langchain-community%3D%3D0.2.9
generic_textual MODERATE https://github.com/langchain-ai/langchain/releases/tag/langchain-community%3D%3D0.2.9
cvssv3 4.8 https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
cvssv3.1 4.8 https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
generic_textual MODERATE https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
ssvc Track https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
cvssv3.1 4.8 https://nvd.nist.gov/vuln/detail/CVE-2024-3095
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-3095
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-3095
https://github.com/langchain-ai/langchain
https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
https://github.com/langchain-ai/langchain/pull/24451
https://github.com/langchain-ai/langchain/releases/tag/langchain-community%3D%3D0.2.9
https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
CVE-2024-3095 https://nvd.nist.gov/vuln/detail/CVE-2024-3095
GHSA-q25c-c977-4cmh https://github.com/advisories/GHSA-q25c-c977-4cmh
No exploits are available.
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/langchain-ai/langchain
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/langchain-ai/langchain/commit/604dfe2d99246b0c09f047c604f0c63eafba31e7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/langchain-ai/langchain/pull/24451
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://github.com/langchain-ai/langchain/releases/tag/langchain-community%3D%3D0.2.9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-07T18:54:30Z/ Found at https://huntr.com/bounties/e62d4895-2901-405b-9559-38276b6a5273
Vector: CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-3095
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.37022
EPSS Score 0.00163
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:21:53.846375+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/langchain/CVE-2024-3095.yml 38.6.0