LangChain SitemapLoader SSRF via Nested Sitemap Domain Filter Bypass

Technical Analysis

The vulnerability lies in SitemapLoader.parse_sitemap, which correctly filters cross-domain leaf <url> entries against restrict_to_same_domain but neglects to apply the same check when recursing into nested <sitemap> index entries, passing the child loc directly to scrape_all and ultimately an aiohttp GET request. This allows an attacker who controls or can influence an ingested sitemap.xml (e.g., via a scraped site, supply-chain content, or user-submitted URL) to embed a nested sitemap pointing to internal/private/loopback/link-local addresses. The agent's document loader, running server-side, fetches that internal resource and parses its content into Documents that are then returned to the caller, effectively exfiltrating internal network responses through the RAG pipeline. This crosses a trust boundary because the security control (domain restriction) is bypassed silently, and the LLM application layer becomes an unwitting proxy for internal reconnaissance and data disclosure.

Affected Systems

LangChain, langchain_community

Detection Signatures

• Outbound aiohttp/HTTP GET requests from document-loader processes to RFC1918, loopback (127.0.0.1), or link-local (169.254.0.0/16) addresses
• Sitemap XML content containing nested <sitemap><loc> entries referencing internal hostnames or IP literals
• Unexpected Document objects in RAG pipeline output containing internal service banners, cloud metadata responses, or admin panel content
• Log entries showing SitemapLoader or WebBaseLoader fetching URLs outside the expected public domain despite restrict_to_same_domain=True

Remediation Steps

1. 1

   Upgrade langchain_community

   Apply the patched version of langchain_community once released that enforces restrict_to_same_domain on both leaf and nested sitemap entries.

2. 2

   Add network-level egress controls

   Deploy egress filtering/firewall rules on hosts running document loaders to block outbound requests to private, loopback, and link-local address ranges regardless of application-layer logic.

3. 3

   Validate URLs before fetch

   Implement a wrapper or custom loader that independently validates every URL (including nested sitemap references) against an allowlist and blocks RFC1918/loopback/link-local targets before any request is made.

4. 4

   Sandbox document ingestion

   Run sitemap/document loading in an isolated network segment or container without access to internal services or cloud metadata endpoints.

5. 5

   Audit ingested content sources

   Restrict which sitemaps or URLs can be submitted for ingestion, and treat externally-influenced sitemap content as untrusted input requiring strict validation.