CVE-2026-72848: langchain-community SitemapLoader Does Not Apply restrict_to_same_domain to Nested Sitemap Index Entries, Allowing Server-Side Request Forgery
SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrapeall([loc.text], "xml"), which reaches WebBaseLoader.scrapeall and an aiohttp GET, with no domain comparison and no check for private, loopback or link-local destinations. An attacker who controls or influences an ingested sitemap can therefore point a nested sitemap entry at an internal address and make the server fetch it even when the deploying application set restricttosamedomain to True specifically to confine outbound requests. The fetched content is parsed and surfaces in the returned Documents, so internal responses are disclosed to the caller rather than merely requested.
Affected Software
Event History
Frequently Asked Questions
Is an application protected if it enables restrict_to_same_domain?
No. The restriction is applied to leaf URL entries but not to nested sitemap index entries, so a nested sitemap location can still cause an outbound fetch to another domain.
What does an attacker need to exploit this issue?
The attacker must control or influence a sitemap ingested by SitemapLoader and include a nested sitemap entry whose loc points to a target address. No authentication or user interaction is required to trigger the server-side request.
How can I determine whether a sitemap ingestion workflow is exposed?
Review sitemaps accepted by the application for nested sitemap loc values, especially values pointing outside the intended domain or at private, loopback, or link-local addresses. If SitemapLoader processes those nested entries, it passes them to WebBaseLoader for fetching without a domain or internal-address check.
What is exposed if the request succeeds?
The fetched nested sitemap content is parsed and returned in Documents. This can disclose internal HTTP responses to the caller, rather than only causing a blind request.