GitHub Advisoryadvisory · PyPI

GHSA-pc6w-59fv-rh23 Langchain Community Vulnerable to XML External Entity (XXE) Attacks

HIGH Published 2025-09-04 Modified 2025-09-05 Official page ↗
Aliases
CVE-2025-6984
Ecosystem
PyPI
Packages
langchain-community
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-611
Reviewed
2025-09-05

Affected packages

• PyPI langchain-community: < 0.3.27 → fixed in 0.3.27

Description

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.

Related

Alias · CVE (1)

  • CVE-2025-6984 The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References