{
 "id": "AIR-2025-0491",
 "slug": "cve-2025-6985-xml-external-entity-vulnerability-in-langchain",
 "title": "CVE-2025-6985: XML External Entity vulnerability in langchain-text-splitters",
 "summary": "The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML external entity attacks through unsafe XSLT parsing. This vulnerability allows attackers to read local files or trigger outbound HTTP fetches depending on the lxml version used.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "langchain-text-splitters"
 ],
 "incident_date": "2025-10-06",
 "incident_date_precision": "day",
 "first_reported": "2025-10-06",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6985",
   "publisher": "NVD",
   "title": "CVE-2025-6985: The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to…",
   "published_at": "2025-10-06"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2025-6985",
  "xxe"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}