/Vulnerability Library

langchain-ai langchain - XML External Entity Injection

CVE-2025-6984
Verified

Description

langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.

Severity

High

CVSS Score

7.5

Exploit Probability

2%

Published Date

September 8, 2025

Template Author

nukunga

CVE-2025-6984.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-6984
CWE ID:
cwe-200

References

https://nvd.nist.gov/vuln/detail/CVE-2025-6984https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2ahttps://github.com/langchain-ai/langchain-community/commit/e842452

Remediation Steps

Update to the latest version that disables external entity references in XML parsing.