Executive brief
LangChain's XMLOutputParser vulnerable to XML Entity Expansion
Affected products
- PyPI langchain-core
Junglewise Threat Intelligence
CVE-2024-1455: PYSEC-2026-1519 - LangChain's XMLOutputParser vulnerable to XML Entity Expansion
CVE-2024-1455 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: langchain-core (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2562 - LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
- PYSEC-2026-1518 - LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
- PYSEC-2026-1517 - langchain-core allows unauthorized users to read arbitrary files from the host file system
- PYSEC-2026-373 - LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
- LangChain unsafe deserialization in load() via broad object allowlists