GHSA-pc6w-59fv-rh23

Suggest an improvement
Source
https://github.com/advisories/GHSA-pc6w-59fv-rh23
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-pc6w-59fv-rh23/GHSA-pc6w-59fv-rh23.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-pc6w-59fv-rh23
Aliases
  • CVE-2025-6984
Published
2025-09-04T12:30:42Z
Modified
2025-09-05T15:57:16.662479Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
Details

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.

Database specific 
{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-200",
        "CWE-611"
    ],
    "github_reviewed_at": "2025-09-05T15:28:25Z",
    "nvd_published_at": "2025-09-04T10:42:33Z",
    "github_reviewed": true
}
References

Affected packages

PyPI / langchain-community

Package

Name
langchain-community
View open source insights on deps.dev
Purl
pkg:pypi/langchain-community

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.3.27

Affected versions

0.*

0.0.1rc1
0.0.1rc2
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.30
0.0.31
0.0.32
0.0.33
0.0.34
0.0.35
0.0.36
0.0.37
0.0.38
0.2.0rc1
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.19
0.3.0.dev1
0.3.0.dev2
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17rc1
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26