Executive brief
Langroid Allows XXE Injection via XMLToolMessage
Affected products
- PyPI langroid
Junglewise Threat Intelligence
CVE-2025-46726: PYSEC-2026-1532 - Langroid Allows XXE Injection via XMLToolMessage
CVE-2025-46726 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: langroid (PyPI). Vendors: PyPI.
Related threats
- Langroid prompt injection in Neo4jChatAgent and ArangoChatAgent
- Langroid unauthorized tool invocation via raw JSON payloads
- Langroid sandbox escape and RCE in TableChatAgent and VectorStore
- Langroid SQLChatAgent regex bypass in SQL injection mitigation
- Langroid path traversal in ReadFileTool and WriteFileTool