LangChainGHSA-pc6w-59fv-rh23
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
High7.5CVE-2025-6984 · Published Sep 4, 2025 · updated Sep 10, 2026
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| langchain-community PyPI | < 0.3.27 | 0.3.27 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200, CWE-611
- Also known as
- CVE-2025-6984, PYSEC-2026-1515
- nvd.nist.gov/vuln/detail/CVE-2025-6984
- github.com/langchain-ai/langchain-community/commit/e842452108089524e22c3a2ced851c021884556f
- github.com/langchain-ai/langchain-community
- github.com/langchain-ai/langchain/blob/d79b5813a0b3b243c612b77013768995e46c4337/libs/langchain/langchain/document_loaders/evernote.py#L1-L23
- huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
More LangChain advisories
All LangChain| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Feb 11 | @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation Medium4.1Feb 11 | Medium4.1 | 1.1.14 |
| Feb 11 | LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messagesLow3.7Feb 11 | Low3.7 | 1.2.11 |
| Dec 232025 | LangChain serialization injection vulnerability enables secret extractionHigh8.6Dec 23, 2025 | High8.6 | 0.3.37+3 more |
| Dec 232025 | LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIsCritical9.3Dec 23, 2025 | Critical9.3 | 0.3.81+1 more |
| Nov 202025 | LangChain Vulnerable to Template Injection via Attribute Access in Prompt TemplatesHighNov 20, 2025 | High | 0.3.80+1 more |
| Jun 232025 | LangChain Community SSRF vulnerability exists in RequestsToolkit componentHigh8.4Jun 23, 2025 | High8.4 | 0.0.28 |