CVE-2025-6984: high-severity vulnerability in langchain-ai/langchain
Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.6%
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
langchain-ai · langchain-ai/langchainRelated CVEs — langchain-ai/langchain
In the same product, most dangerous first.
CVE-2025-2828HIGHSSRF Vulnerability in RequestsToolkit in langchain-ai/langchainEPSS 21.0%CVE-2024-8309MEDIUMSQL Injection in langchain-ai/langchainEPSS 13.7%CVE-2024-3571MEDIUMPath Traversal in langchain-ai/langchainEPSS 1.9%CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2024-3095MEDIUMSSRF in Langchain Web Research Retriever in langchain-ai/langchainEPSS 0.7%CVE-2024-0243LOWServer-side Request Forgery In Recursive URL LoaderEPSS 0.5%