SSRF CVE Hits an Archived langchain-community Package

A High-Severity SSRF Was Published Against langchain-community. The Repository Was Archived Two Months Earlier.

CVE-2026-72848 carries the tag "unsupported when assigned", and GitHub's advisory lists the patched version as unknown. There is no fix to apply.

Aug 21, 2026Source: NVD

A server-side request forgery flaw in LangChain's community integrations package was published to the CVE list on 20 August and reached GitHub's advisory database the following day. SitemapLoader.parse_sitemap applies the documented restrict_to_same_domain control only to leaf url entries: the loop over nested sitemap elements passes the constraint over, so an attacker-supplied sitemap index can pull the loader to arbitrary internal hosts. Because the fetched content is parsed into the returned Documents, internal responses are disclosed to the caller, not merely requested.

The part that makes it unusual

The advisory is tagged "unsupported when assigned". Checking the project directly: the langchain-ai/langchain-community repository is archived, its last push was 19 June 2026, and the most recent release on PyPI is 0.4.2, uploaded 22 May 2026. GitHub's advisory page lists the affected versions as unknown, the patched versions as unknown, and no package at all. The upstream issue describing exactly this bug was opened on 12 July and closed as completed on 13 August — a week before the CVE appeared.

What the common framing gets wrong

Advisories of this kind get written up as "patch now." There is nothing to patch. A closed upstream issue on an archived repository does not produce a release, and the advisory itself declines to name a fixed version. The correct remediation is to stop using the loader or constrain it at the network layer — not to upgrade. Second, the severity figure being quoted is not NVD's: the page states "NVD assessment not yet provided," and the 8.6 CVSS 3.1 score comes from VulnCheck, the assigning authority, which separately scores it 7.7 under CVSS 4.0. Two scores, one vendor, no independent assessment.

The structural problem

langchain-community was the catch-all package holding hundreds of third-party integrations, and it was deprecated in favour of standalone packages. Deprecation moved maintenance forward; it did not move the installed base. Vulnerabilities will keep being found in code that is still widely imported and no longer has anywhere for a fix to land. This is the first prominent AI-tooling CVE where the sunset, not the bug, is the story.

Why It Matters

The AI tooling stack is young enough that packages are already being retired while still deeply embedded in production. When an archived dependency draws a high-severity CVE, the usual advice — upgrade — has no meaning.