CVE-2026-72848Published

langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery

Explicit identifiers and source references

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-72848 · Microsoft / collected KEV context

cve-program · CVE-2026-72848

https://github.com/langchain-ai/langchain/issues/38814
https://github.com/langchain-ai/langchain-community/blob/main/libs/community/langchain_community/document_loaders/sitemap.py
https://github.com/langchain-ai/langchain-community
https://www.vulncheck.com/advisories/langchain-community-sitemaploader-does-not-apply-restrict-to-same-domain-to-nested-sitemap-index-entries-allowing-server-side-request-forgery

Related operational evidence

Explicit CVE identifiers

No related operational record is retained in the current change model.