CVE-2025-6984: Langchain Community XML External Entity Vulnerability

# CVE-2025-6984: Langchain Community XML External Entity Vulnerability

https://gcdradar.vercel.app/incidents/cve-2025-6984-langchain-community-xml-external-entity-vulner · AIR-2025-0331 · closed 2025-09-04

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-09-04
- AI role: Attack on AI
- Products: langchain-community, LangChain
- CVE ids: CVE-2025-6984
- CVSS: 7.5

## Summary

The EverNoteLoader component in LangChain Community is vulnerable to XML External Entity attacks due to insecure XML parsing. An attacker could exploit this to read local files, and the issue has been fixed in version 0.3.27.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-09-04: CVE-2025-6984: The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks… (https://nvd.nist.gov/vuln/detail/CVE-2025-6984)
- 2025-09-04: CVE-2025-6984: Langchain Community Vulnerable to XML External Entity (XXE) Attacks (https://github.com/advisories/GHSA-pc6w-59fv-rh23)

## Sources

- 2025-09-04 GitHub Advisory Database: CVE-2025-6984: Langchain Community Vulnerable to XML External Entity (XXE) Attacks https://github.com/advisories/GHSA-pc6w-59fv-rh23
- 2025-09-04 NVD: CVE-2025-6984: The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks… https://nvd.nist.gov/vuln/detail/CVE-2025-6984

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.