{
 "id": "AIR-2024-0133",
 "slug": "cve-2024-3095-ssrf-in-langchain-community-web-research-retri",
 "title": "CVE-2024-3095: SSRF in langchain-community Web Research Retriever",
 "summary": "A Server-Side Request Forgery vulnerability in the LangChain community Web Research Retriever permits remote requests to local addresses. Attackers can exploit this flaw to conduct port scans and access cloud instance metadata.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "langchain-community"
 ],
 "incident_date": "2024-06-06",
 "incident_date_precision": "day",
 "first_reported": "2024-06-06",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-q25c-c977-4cmh",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2024-3095: Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever",
   "published_at": "2024-06-06"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3095",
   "publisher": "NVD",
   "title": "CVE-2024-3095: A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain…",
   "published_at": "2024-06-06"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2024-3095",
  "ssrf",
  "langchain"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}