a2a-client-handler (0.1.0), aa-rag (>=0.1.0, <=0.4.3) +597 more potentially affected by CVE-2025-6985 via langchain-text-splitters (>=0.0.1, <=0.3.8)

langchain-text-splitters PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.0, =0.0.2, =0.1.31, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6985 Source advisory: MEND:CVE-2025-6985...

CVE-2025-6985: Improper Restriction of XML External Entity Reference

The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity XXE attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse and lxml.etree.XSL...

langchain-text-splitters code issue vulnerability

langchain-text-splitters is a Python package open-sourced by LangChain. A code issue vulnerability exists in langchain-text-splitters version 0.3.8, which stems from the HTMLSectionSplitter class allowing the use of arbitrary XSLT stylesheets, which could lead to an XML External Entity Attack,...

XML External Entity (XXE) Injection

Overview langchain-text-splitters is a LangChain text splitting utilities Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insecure XML parser configurations and the presence of the xsltpath parameter in the HTMLSectionSplitter class. Details XXE...

a2a-client-handler (0.1.0), aa-rag (>=0.1.0, <=0.4.3) +597 more potentially affected by CVE-2025-6985 via langchain-text-splitters (>=0.0.1, <=0.3.8)

langchain-text-splitters PYPI version =0.0.1, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.0, =0.0.2, =0.1.31, =0.0.1, =0.1.0, =0.1.2 and more Source cves: CVE-2025-6985 Source advisory: SNYK:PYTHON-LANGCHAINTEXTSPLITTERS-12704815...