Langroid Allows XXE Injection via XMLToolMessage

SummaryA LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. DetailsXMLToolMessage uses lxml without...

The vulnerability in the XMLToolMessage class of the langroid Python framework for application development allows a attacker to trigger a service failure or disclose protected information.

The vulnerability of the XMLToolMessage class in the langroid application development framework is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow a malicious actor to cause service failures or expose sensitive information...

EUVD-2025-13410

Malicious code in bioql PyPI...

GHSA-PW95-88FG-3J6F Langroid Allows XXE Injection via XMLToolMessage

Summary A LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Details XMLToolMessage uses lxml without safeguards:...

CVE-2025-46726 Langroid Vulnerable to XXE Injection via XMLToolMessage

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Version 0.53.4 fixes th...

CVE-2025-46726 Langroid Vulnerable to XXE Injection via XMLToolMessage

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging XMLToolMessage class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Version 0.53.4 fixes th...