Malicious HTML file download vulnerability in Recursive URLLoader

CVE-2024-0243

What is CVE-2024-0243?

The Recursive URL Loader in Langchain is susceptible to an HTML file inclusion vulnerability, allowing an attacker to potentially load malicious files. If an attacker controls the content at a specified URL, they can craft HTML files with links directing to external resources. This can occur even when 'prevent_outside' configurations are set, presenting a significant risk for unintended file retrieval and external data compromise. To mitigate this issue, it is crucial to update to the latest version where the vulnerability is resolved.

References