Vulnonym.com

CVE-2026-26013 - Well appointed Copulate

Description

LangChain is a framework for building agents and LLM-powered applications. Prior to 1.2.11, the ChatOpenAI.get_num_tokens_from_messages() method fetches arbitrary image_url values without validation when computing token counts for vision-enabled models. This allows attackers to trigger Server-Side Request Forgery (SSRF) attacks by providing malicious image URLs in user input. This vulnerability is fixed in 1.2.11.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Reference

https://github.com/langchain-ai/langchain/commit/2b4b1dc29a833d4053deba4c2b77a3848c834565 https://github.com/langchain-ai/langchain/releases/tag/langchain-core%3D%3D1.2.11 https://github.com/langchain-ai/langchain/security/advisories/GHSA-2g6r-c272-w58r

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

Base Score

3.7

Base Severity

LOW

Remediation Step-by-Step Guide

  1. Upgrade LangChain to Version 1.2.11 or Higher
    • Run pip install --upgrade langchain to ensure you are using version 1.2.11 or later, where the vulnerability has been patched.
  2. Verify the Installed Version
    • Execute pip show langchain and confirm that the version is 1.2.11 or greater.
  3. Review All User Input Handling in LLM Applications
    • Audit all code paths that pass user-supplied image URLs to ChatOpenAI.get_num_tokens_from_messages() or similar methods.
    • Ensure no untrusted input is directly used in image URL resolution.
  4. Implement Input Validation and Sanitization
    • Validate all image_url values against a whitelist of trusted domains (e.g., only allow URLs from your organization’s approved image hosts).
    • Use a URL parsing library to enforce valid HTTP/HTTPS schemes and reject malformed or non-standard protocols (e.g., file://, gopher://).
  5. Disable Image URL Processing if Not Required
    • If your application does not require vision capabilities, disable image processing entirely by avoiding the use of image_url in message payloads.
  6. Apply Network-Level Protections
    • Configure outbound firewall rules to block access to internal metadata endpoints (e.g., 169.254.169.254) and private IP ranges.
    • Deploy a Web Application Firewall (WAF) to detect and block suspicious HTTP requests originating from LLM inputs.
  7. Monitor for Exploitation Attempts
    • Log all external HTTP requests initiated by the application, especially those triggered during token counting.
    • Set up alerts for requests to internal IPs, metadata services, or unexpected domains.
  8. Test the Fix
    • Use a test payload containing malicious image URLs (e.g., http://169.254.169.254/latest/meta-data/) to verify the fix prevents SSRF.
    • Confirm that image URLs are either rejected or safely handled without triggering external requests.
  9. Update Dependency Management
    • Integrate dependency scanning tools (e.g., Snyk, Dependabot) into your CI/CD pipeline to automatically detect and alert on vulnerable library versions.
  10. Document and Communicate the Fix
    • Update your security incident response plan to include this vulnerability.
    • Notify all developers and third-party integrators of the patch requirement.

Context within ISO/IEC 27001 and NIST Frameworks

ISO/IEC 27001 Control Mapping

  • A.14.1.3 – Secure Development Policy
    Requires secure coding practices and validation of external inputs to prevent injection and SSRF attacks. The vulnerability arises from lack of input validation during token computation.

  • A.13.1.1 – Network Security Management
    Mitigates SSRF by enforcing network segmentation and blocking outbound connections to internal metadata services.

  • A.14.2.5 – Secure System Architecture
    Mandates that systems are designed to minimize attack surfaces — allowing untrusted URLs in token processing violates this principle.

  • A.12.6.1 – Technical Vulnerability Management
    Requires timely patching of known vulnerabilities; failure to upgrade from pre-1.2.11 violates this control.

NIST SP 800-53 Control Mapping

  • SI-2 (System and Information Integrity)
    Requires detection and remediation of system vulnerabilities. The unpatched LangChain version represents an exploitable flaw that must be remediated.

  • SI-4 (System Monitoring)
    Requires monitoring for anomalous network behavior — SSRF attempts should be logged and alerted.

  • AC-17 (Remote Access)
    While focused on remote access, this control’s principle of restricting external connectivity applies to outbound SSRF requests.

  • SC-7 (Boundary Protection)
    Requires enforcement of boundary protections to prevent unauthorized data transfers — SSRF bypasses application boundaries by triggering internal resource access.

  • SI-10 (Information Input Validation)
    Directly applicable: unvalidated user input (image URLs) led to SSRF. Input validation must be enforced at all entry points, including LLM inputs.

  • RA-5 (Vulnerability Scanning)
    Requires regular scanning for vulnerabilities. Organizations must scan dependencies and apply patches promptly.