CVE-2025-6984

HIGHNuclei

Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-6984 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 4, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

langchain-ai/langchain

Browse langchain-ai / langchain-ai/langchain
CVE ListThrough latestaffected

langchain-community

Browse PyPI / langchain-community
GitHub AdvisoryBefore 0.3.27 · Fixed in 0.3.27affected

Nuclei templates

1
ProjectDiscoveryHIGHlangchain-ai langchain - XML External Entity InjectionCVSS 7.5

langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.

Impact

Attackers can disclose sensitive local files, potentially exposing critical system information.

Remediation

Update to the latest version that disables external entity references in XML parsing.

WeaknessesCWE-200
Authorsnukunga
Template tagscvecve2025langchainxxeintrusivefile-write
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
https://nvd.nist.gov/vuln/detail/CVE-2025-6984 https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a https://github.com/langchain-ai/langchain-community/commit/e842452

Source: ProjectDiscovery

References

5