https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:58:58.209384+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-6984 CVE-2025-6984 — Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain 2026-10-02T16:58:58.226441+00:00

Affected: langchain-ai/langchain

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.

 https://cve.radiocsirt.org/vuln/ghsa-pc6w-59fv-rh23 GHSA-pc6w-59fv-rh23 — Langchain Community Vulnerable to XML External Entity (XXE) Attacks 2026-10-02T16:58:58.226496+00:00

Affected: PyPI: langchain-community

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd. This issue has been fixed in 0.3.27 of langchain-community.