CVE-2026-72848

Received Received - Intake

Sitemap XML External Entity Injection in LangChain

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description

SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no domain comparison and no check for private, loopback or link-local destinations. An attacker who controls or influences an ingested sitemap can therefore point a nested sitemap entry at an internal address and make the server fetch it even when the deploying application set restrict_to_same_domain to True specifically to confine outbound requests. The fetched content is parsed and surfaces in the returned Documents, so internal responses are disclosed to the caller rather than merely requested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-72848

EUVD

EUVD-2026-63732

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves SitemapLoader.parse_sitemap in langchain_community. It fails to enforce the restrict_to_same_domain setting for nested sitemap entries. Attackers can exploit this by pointing nested entries to internal addresses, causing the server to fetch and disclose internal content even when domain restrictions are enabled.

Detection Guidance

This vulnerability involves improper handling of nested sitemap entries in LangChain's SitemapLoader, allowing internal network requests. To detect it, monitor outbound HTTP requests from the affected application, especially those originating from the sitemap parsing process. Check logs for unexpected connections to internal or private IP addresses triggered by sitemap ingestion.

Impact Analysis

An attacker could access sensitive internal data by manipulating sitemap files. This could lead to unauthorized information disclosure, data leaks, or further attacks if internal services are exposed. The impact depends on what internal resources the server can access.

Compliance Impact

This vulnerability could violate compliance by exposing protected data (e.g., personal health or user information) to unauthorized parties. GDPR and HIPAA require safeguards against unauthorized data access, which this flaw undermines.

Mitigation Strategies

Update the langchain_community library to a patched version where restrict_to_same_domain applies to all sitemap entries. If no patch is available, disable sitemap loading or restrict outbound requests at the network level to prevent access to internal addresses.

Hi! I’m here to help you understand CVE-2026-72848. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70