LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurl_loader.py because crawling can proceed from an external server to an internal server.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46229.json"