CVE-2025-6984: Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.
Other sources
The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6984?
CVE-2025-6984 has a high severity rating due to its potential to lead to XML External Entity attacks.
How do I fix CVE-2025-6984?
To fix CVE-2025-6984, update the EverNoteLoader component to a version where external entity parsing is disabled.
What products are affected by CVE-2025-6984?
The langchain-ai/langchain project, specifically version 0.3.63 of the EverNoteLoader component, is affected by CVE-2025-6984.
How can CVE-2025-6984 be exploited?
CVE-2025-6984 can be exploited through malicious XML input that leverages external entity references.
What are the potential impacts of CVE-2025-6984?
The potential impacts of CVE-2025-6984 include data exposure and denial of service due to the improper handling of XML input.