CVE-2025-6985: XML External Entity vulnerability in langchain-text-splitters

# CVE-2025-6985: XML External Entity vulnerability in langchain-text-splitters

https://gcdradar.vercel.app/incidents/cve-2025-6985-xml-external-entity-vulnerability-in-langchain · AIR-2025-0491 · closed 2025-10-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-10-06
- AI role: Attack on AI
- Products: langchain-text-splitters
- CVE ids: CVE-2025-6985
- CVSS: 7.5

## Summary

The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML external entity attacks through unsafe XSLT parsing. This vulnerability allows attackers to read local files or trigger outbound HTTP fetches depending on the lxml version used.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-10-06: CVE-2025-6985: The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to… (https://nvd.nist.gov/vuln/detail/CVE-2025-6985)

## Sources

- 2025-10-06 NVD: CVE-2025-6985: The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to… https://nvd.nist.gov/vuln/detail/CVE-2025-6985

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.