Executive brief
Langchain Community Vulnerable to XML External Entity (XXE) Attacks
Affected products
- PyPI langchain-community
Junglewise Threat Intelligence
CVE-2025-6984: PYSEC-2026-1515 - Langchain Community Vulnerable to XML External Entity (XXE) Attacks
CVE-2025-6984 · Severity: low · CVSS 3 · Published 2026-07-07
Technologies: langchain-community (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2561 - Denial of service in langchain-community
- PYSEC-2026-1507 - Langchain SQL Injection vulnerability
- PYSEC-2026-1514 - LangChain pickle deserialization of untrusted data
- PYSEC-2026-1516 - Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
- PYSEC-2025-70 - A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically