CVE-2026-72848

This vulnerability in LangChain's SitemapLoader exposes a security failure that is structural rather than accidental: the component enforces domain restriction on one XML parsing loop but not on a parallel loop processing the same input format. The parameter `restrict_to_same_domain=True` is documented and appears to provide a security boundary—but that boundary only applies to the `<url>` element loop. The `<sitemap>` element loop, which processes nested sitemap entries with identical XML structure and calls the same scrape method, lacks this check entirely. An attacker who controls a sitemap served to a vulnerable deployment can point the loader at internal resources—the attack surface includes cloud metadata endpoints (169.254.169.254), internal dashboards, actuator endpoints, and private APIs. The returned content arrives as parsed Document objects, which downstream code is likely to treat as trusted because they originate from a loader the caller configured with security constraints. This creates a silent exfiltration path: the application developer explicitly set a security boundary that was silently violated through a code path they had no reason to suspect was dangerous. The fix appears to require adding the domain check to the sitemap loop, but this is analytically insufficient. The underlying abstraction permits two parallel parsing paths where only one receives security enforcement—this structure makes the same mistake reproducible when future developers add a third traversal path (image sitemaps, video sitemaps). The proper fix extracts the security logic into a shared validation layer that neither loop can bypass without obvious violation. Review your deployment: confirm whether SitemapLoader is used with `restrict_to_same_domain=True`, and whether any downstream processing treats the returned Documents as inherently trusted content. The blast radius extends beyond the fetch—the Document objects carry internal content into contexts that may not inspect their origin.

Reviewed through automated stages and approved by a human before publication.