CVE-2025-6985: langchain-ai/langchain · XML External Entity (XXE)
Affects langchain-ai/langchainSource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 43% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| langchain-ai langchain-ai/langchain | Affected
| Fixed in– |
AI-suggested
European organizations should immediately audit their use of langchain-ai/langchain, especially the HTMLSectionSplitter class and any features that allow custom XSLT stylesheets. Mitigation steps include: 1) Upgrading to a patched version of langchain-text-splitters once available or applying vendor-provided patches. 2) If upgrading is not immediately possible, disable or restrict the use of custom XSLT inputs to trusted sources only. 3) Implement XSLTAccessControl or equivalent hardening when using lxml.etree.XSLT to restrict document() function access and external entity resolution. 4) Employ runtime security controls such as container or process-level file system restrictions to limit file access by LangChain processes. 5) Monitor logs for unusual file access patterns or outbound HTTP(S) requests initiated by LangChain components. 6) Conduct internal code reviews and penetration tests focusing on XML and XSLT processing components. 7) Educate developers and DevOps teams about the risks of unsafe XML/XSLT parsing and enforce secure coding practices. 8) Consider network-level controls to restrict outbound HTTP(S) traffic from LangChain hosts to prevent data exfiltration via document().
Description
The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse() and lxml.etree.XSLT() without any hardening measures. In lxml versions up to 4.9.x, external entities are resolved by default, allowing attackers to read arbitrary local files or perform outbound HTTP(S) fetches. In lxml versions 5.0 and above, while entity expansion is disabled, the XSLT document() function can still read any URI unless XSLTAccessControl is applied. This vulnerability allows remote attackers to gain read-only access to any file the LangChain process can reach, including sensitive files such as SSH keys, environment files, source code, or cloud metadata. No authentication, special privileges, or user interaction are required, and the issue is exploitable in default deployments that enable custom XSLT.