Description
Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Version 0.53.4 fixes the issue.
References (3)
Scores
CVSS v3
9.1
EPSS
0.0045
EPSS Percentile
63.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-611
Status
published
Products (2)
langroid/langroid
< 0.53.4
pypi/langroid
0 - 0.53.4PyPI
Published
May 05, 2025
Tracked Since
Feb 18, 2026