a-data-processing (0.0.1), a2a-client-handler (0.1.0) +645 more potentially affected by CVE-2025-6984 via langchain-community (>=0.0.1, <=0.3.26)

langchain-community PYPI version =0.0.1, =0.1.0, =4.8.2, =0.1.0, =0.1.0, =0.1.1, =0.0.2, =0.1.16, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6984 Source advisory: OSV:GHSA-PC6W-59FV-RH23...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +645 more potentially affected by CVE-2025-6984 via langchain-community (>=0.0.1, <=0.3.26)

langchain-community PYPI version =0.0.1, =0.1.0, =4.8.2, =0.1.0, =0.1.0, =0.1.1, =0.0.2, =0.1.16, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6984 Source advisory: GHSA-PC6W-59FV-RH23...

CVE-2025-6984 Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which...

CVE-2025-6984 Sensitive Information Disclosure Due to Insecure XML Parsing in langchain-ai/langchain

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +645 more potentially affected by CVE-2025-6984 via langchain-community (>=0.0.1, <=0.3.26)

langchain-community PYPI version =0.0.1, =0.1.0, =4.8.2, =0.1.0, =0.1.0, =0.1.1, =0.0.2, =0.1.16, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6984 Source advisory: MEND:CVE-2025-6984...

a-data-processing (0.0.1), a2a-client-handler (0.1.0) +645 more potentially affected by CVE-2025-6984 via langchain-community (>=0.0.1, <=0.3.26)

langchain-community PYPI version =0.0.1, =0.1.0, =4.8.2, =0.1.0, =0.1.0, =0.1.1, =0.0.2, =0.1.16, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6984 Source advisory: SNYK:PYTHON-LANGCHAINCOMMUNITY-12510808...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via insecure use of etree.iterparse parsing. An attacker can access sensitive information by submitting crafted XML payload with referencies to local files. Details XXE Injection is a type of attack...

CVE-2025-6984

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which...

LangChain information leakage vulnerability

LangChain is a LangChain open source framework for developing applications powered by the Large Language Model LLM. An information disclosure vulnerability exists in LangChain version 0.3.63, which stems from insecure XML parsing and could lead to the disclosure of sensitive information...

CVE-2025-6984: Exposure of Sensitive Information to an Unauthorized Actor

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity XXE attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse without disabling external entity references, which...

SUSE CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

VulnCheck KEV: CVE-2023-44467

langchainexperimental aka LangChain Experimental in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via import in Python code, which is not prohibited by palchain/base.py...

VulnCheck KEV: CVE-2023-46229

LangChain before 0.0.317 allows SSRF via documentloaders/recursiveurlloader.py because crawling can proceed from an external server to an internal server...

centricube-langchain (>=1.2.3, <=1.3.0), centricube-pyautogen (>=0.3.2, <=0.3.3) +5 more potentially affected by CVE-2025-55197 via pypdf (5.6.1)

pypdf PYPI version 5.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - centricube-langchain =1.2.3, =0.3.2, =0.3.0, =0.1.0, =0.0.11, =0.0.3, =0.0.5 Source cves: CVE-2025-55197 Source advisory: OSV:GHSA-7HFW-26VP-JP8M...

CVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request...

CVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request...

CVE-2025-45150

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request...

XML External Entity (XXE) Injection

Overview langchain-text-splitters is a LangChain text splitting utilities Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insecure XML parser configurations and the presence of the xsltpath parameter in the HTMLSectionSplitter class. Details XXE...

a2a-client-handler (0.1.0), aa-rag (>=0.1.0, <=0.4.3) +597 more potentially affected by CVE-2025-6985 via langchain-text-splitters (>=0.0.1, <=0.3.8)

langchain-text-splitters PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.0, =0.0.2, =0.1.31, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6985 Source advisory: SNYK:PYTHON-LANGCHAINTEXTSPLITTERS-12704815...

CVE-2025-45150

The LangChain-ChatGLM-Webui open-source AI tool (specifically commit ef829 ) is vulnerable to an insecure permissions issue. An attacker can arbitrarily view and download sensitive files by submitting a specially crafted request. The documentation provides no information regarding specific exploi...