{
 "id": "AIR-2025-0331",
 "slug": "cve-2025-6984-langchain-community-xml-external-entity-vulner",
 "title": "CVE-2025-6984: Langchain Community XML External Entity Vulnerability",
 "summary": "The EverNoteLoader component in LangChain Community is vulnerable to XML External Entity attacks due to insecure XML parsing. An attacker could exploit this to read local files, and the issue has been fixed in version 0.3.27.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "langchain-community",
  "LangChain"
 ],
 "incident_date": "2025-09-04",
 "incident_date_precision": "day",
 "first_reported": "2025-09-04",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-pc6w-59fv-rh23",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-6984: Langchain Community Vulnerable to XML External Entity (XXE) Attacks",
   "published_at": "2025-09-04"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6984",
   "publisher": "NVD",
   "title": "CVE-2025-6984: The langchain-ai/langchain project, specifically the EverNoteLoader component, is vulnerable to XML External Entity (XXE) attacks…",
   "published_at": "2025-09-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-6984",
  "xxe"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}