CVE-2026-72848: LangChain Community SitemapLoader

CISO Take

LangChain Community's SitemapLoader enforces its restrict_to_same_domain flag only on the leaf URLs of a sitemap, but blindly follows nested sitemap-index entries to any address the attacker controls, turning an XML parsing loop into a server-side request forgery primitive. Any application that ingests third-party or user-influenced sitemaps for RAG or crawling — even one that explicitly set restrict_to_same_domain=True to lock outbound fetches to a trusted domain — can be coerced into GETting internal, loopback or link-local endpoints, with the response content parsed and handed straight back to the caller as a Document. No authentication or user interaction is required (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N), and while it isn't in CISA KEV and no public exploit or Nuclei template exists yet, the flaw is trivial to weaponize once an attacker can plant or influence a sitemap URL, and langchain-community sees heavy adoption across RAG ingestion pipelines. Treat this as a silent bypass of a control teams believe is protecting them: audit anywhere SitemapLoader ingests externally-supplied sitemaps, pin to a patched langchain-community release once available, and in the meantime front outbound fetches with an egress allowlist or metadata-service block (deny 169.254.169.254, RFC1918, and loopback ranges) rather than relying on the library's own domain check.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

Network-exploitable with low attack complexity and no privileges or user interaction (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) — impact is confidentiality-only (internal response disclosure), with no integrity or availability effect, but the scope-changed vector reflects that the request escapes the application's own trust boundary into internal network space. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template observed, so this is not yet under mass exploitation, but the bug is conceptually trivial (a single missing domain check in a loop that already has the correct check one branch over) and requires only the ability to influence a sitemap that gets ingested — a low bar for any pipeline that crawls partner, customer, or public sitemaps. Exposure is elevated by the fact this defeats a control (restrict_to_same_domain) that deployers explicitly enable believing it closes exactly this SSRF path.

How does the attack unfold?

Content Control

Attacker controls or influences a sitemap ingested by a LangChain-based application, e.g. via a partner site or user-submitted crawl target.

AML.T0066

Nested Sitemap Injection

Attacker crafts a sitemap index whose nested <sitemap><loc> entry points to an internal, loopback, or link-local address instead of a legitimate child sitemap.

SSRF Exploitation

SitemapLoader.parse_sitemap skips the restrict_to_same_domain check for nested entries and passes the malicious loc to scrape_all, triggering an aiohttp GET to the internal target.

AML.T0049

Internal Data Disclosure

The fetched internal response is parsed and returned as a LangChain Document, exposing internal service or metadata content to the caller through the application's normal output path.

AML.T0025

Content Control

Attacker controls or influences a sitemap ingested by a LangChain-based application, e.g. via a partner site or user-submitted crawl target.

AML.T0066

Nested Sitemap Injection

Attacker crafts a sitemap index whose nested <sitemap><loc> entry points to an internal, loopback, or link-local address instead of a legitimate child sitemap.

SSRF Exploitation

SitemapLoader.parse_sitemap skips the restrict_to_same_domain check for nested entries and passes the malicious loc to scrape_all, triggering an aiohttp GET to the internal target.

AML.T0049

Internal Data Disclosure

The fetched internal response is parsed and returned as a LangChain Document, exposing internal service or metadata content to the caller through the application's normal output path.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LangChain Community	pip	—	No patch
148.8KOpenSSF 5.71.3K dependentsPushed today50% patched~48d to patchFull package profile →

Do you use LangChain Community? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CHigh

INone

ANone

What should I do?

1 step

Upgrade langchain-community once a patched release addressing this is available (track github.com/langchain-ai/langchain/issues/38814 and the VulnCheck advisory for the fix version). Until then, do not rely on restrict_to_same_domain alone — pre-parse and validate sitemap XML yourself, stripping or rejecting any <sitemap><loc> entry that resolves off the expected domain before handing content to SitemapLoader, or wrap/monkeypatch the scrape_all call to add the missing check. Add network-layer egress controls on hosts running ingestion workers: deny RFC1918, loopback, and link-local ranges (especially the 169.254.169.254 cloud metadata endpoint) at the firewall/NACL level so the application-layer bug can't reach sensitive infrastructure even if triggered. Monitor outbound HTTP logs from ingestion/crawler workers for requests to internal IP ranges as a detection signal, and treat all externally-sourced sitemaps as untrusted input requiring sandboxed fetch.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionFrameworkRAGAML.T0025- Exfiltration via Cyber Means AML.T0049- Exploit Public-Facing Application AML.T0066- Retrieval Content Crafting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-72848?

LangChain Community's SitemapLoader enforces its restrict_to_same_domain flag only on the leaf URLs of a sitemap, but blindly follows nested sitemap-index entries to any address the attacker controls, turning an XML parsing loop into a server-side request forgery primitive. Any application that ingests third-party or user-influenced sitemaps for RAG or crawling — even one that explicitly set restrict_to_same_domain=True to lock outbound fetches to a trusted domain — can be coerced into GETting internal, loopback or link-local endpoints, with the response content parsed and handed straight back to the caller as a Document. No authentication or user interaction is required (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N), and while it isn't in CISA KEV and no public exploit or Nuclei template exists yet, the flaw is trivial to weaponize once an attacker can plant or influence a sitemap URL, and langchain-community sees heavy adoption across RAG ingestion pipelines. Treat this as a silent bypass of a control teams believe is protecting them: audit anywhere SitemapLoader ingests externally-supplied sitemaps, pin to a patched langchain-community release once available, and in the meantime front outbound fetches with an egress allowlist or metadata-service block (deny 169.254.169.254, RFC1918, and loopback ranges) rather than relying on the library's own domain check.

Is CVE-2026-72848 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-72848, increasing the risk of exploitation.

How to fix CVE-2026-72848?

Upgrade langchain-community once a patched release addressing this is available (track github.com/langchain-ai/langchain/issues/38814 and the VulnCheck advisory for the fix version). Until then, do not rely on restrict_to_same_domain alone — pre-parse and validate sitemap XML yourself, stripping or rejecting any <sitemap><loc> entry that resolves off the expected domain before handing content to SitemapLoader, or wrap/monkeypatch the scrape_all call to add the missing check. Add network-layer egress controls on hosts running ingestion workers: deny RFC1918, loopback, and link-local ranges (especially the 169.254.169.254 cloud metadata endpoint) at the firewall/NACL level so the application-layer bug can't reach sensitive infrastructure even if triggered. Monitor outbound HTTP logs from ingestion/crawler workers for requests to internal IP ranges as a detection signal, and treat all externally-sourced sitemaps as untrusted input requiring sandboxed fetch.

What systems are affected by CVE-2026-72848?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, document ingestion / web crawling, agent frameworks, data ingestion pipelines.

What is the CVSS score for CVE-2026-72848?

CVE-2026-72848 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.60%.

What is the AI security impact?

Affected AI Architectures

RAG pipelinesdocument ingestion / web crawlingagent frameworksdata ingestion pipelines

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0049Exploit Public-Facing Application

AML.T0066Retrieval Content Crafting

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no domain comparison and no check for private, loopback or link-local destinations. An attacker who controls or influences an ingested sitemap can therefore point a nested sitemap entry at an internal address and make the server fetch it even when the deploying application set restrict_to_same_domain to True specifically to confine outbound requests. The fetched content is parsed and surfaces in the returned Documents, so internal responses are disclosed to the caller rather than merely requested.

Exploitation Scenario

An attacker who can influence a sitemap consumed by a LangChain-based ingestion job — e.g., submitting a sitemap URL to a customer-content crawler, or compromising/spoofing a partner site's sitemap — crafts a sitemap index whose nested <sitemap><loc> points to http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal admin endpoint. Even though the deploying team set restrict_to_same_domain=True expecting the loader to refuse cross-domain fetches, the nested-sitemap loop skips that check entirely, and WebBaseLoader.scrape_all issues the GET, parses the response, and returns it as a Document — surfacing cloud credentials or internal service data directly in the RAG pipeline's output, where it can leak into embeddings, admin logs, or a downstream chat response to an unrelated user.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.