Cloudanix VulnDB

CVE-2025-6984

High · 7.5

CVSS

7.5

EPSS

1.6%

Published

Sep 4, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A note-loading feature in some AI software can be tricked into reading and exposing private files from the computer when given specially made data.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Library
Class
XXE
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insecure use of etree.iterparse() in EverNoteLoader permits XML External Entity processing, allowing crafted XML documents to reference and retrieve arbitrary local files via the parser.

Why it matters to the business

Attackers may obtain sensitive server files containing credentials or configuration data, enabling lateral movement or data theft with minimal attacker effort and low detection likelihood.

How an attack unfolds

An attacker supplies a malicious XML document containing an external entity that references a local file such as /etc/passwd to the vulnerable EverNoteLoader; the parser resolves the entity and returns the file contents in the response.

How to fix it

Upgrade langchain to a version after 0.3.63 that configures the XML parser to disable external entity resolution; alternatively, replace direct use of etree.iterparse with a hardened parser that explicitly sets resolve_entities=False.

How to confirm the fix worked

Review source code for EverNoteLoader XML handling to confirm external entities are disabled; test by submitting a benign XXE payload and verifying that file contents are not returned.

Typical attack path

  1. Locate an application endpoint or workflow that invokes the vulnerable EverNoteLoader
  2. Prepare an XML payload embedding an external entity declaration referencing a target local file
  3. Deliver the payload through supported input channels to the loader
  4. Observe the parsed response containing the disclosed file contents

How to detect it

Search application and system logs for XML parsing activity involving langchain or EverNoteLoader, especially entries referencing unexpected local file paths or entity resolution errors.

  • etree.iterparse
  • /etc/passwd
  • <!ENTITY
  • EverNoteLoader

What your security team should do

  • Immediately update the langchain package to a patched release
  • Audit all code paths that invoke EverNoteLoader and restrict untrusted XML input
  • Add runtime input validation to reject XML containing entity declarations
  • Monitor application logs for unexpected file-system access patterns during XML parsing

The record

The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63. The vulnerability arises from the use of etree.iterparse() without disabling external entity references, which can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data such as /etc/passwd.

Affected packages

Ecosystem Package Introduced Fixed
PyPI langchain-community 0 0.3.27
Chainguard open-webui 0 0.6.27-r0
Chainguard open-webui-compat 0 0.6.27-r0
Wolfi open-webui 0 0.6.27-r0
Wolfi open-webui-compat 0 0.6.27-r0

Related vulnerabilities