BaseFortify

Publication date: 2025-10-06

Last updated on: 2025-10-08

Assigner: huntr.dev

Description

The HTMLSectionSplitter class in langchain-text-splitters version 0.3.8 is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse() and lxml.etree.XSLT() without any hardening measures. In lxml versions up to 4.9.x, external entities are resolved by default, allowing attackers to read arbitrary local files or perform outbound HTTP(S) fetches. In lxml versions 5.0 and above, while entity expansion is disabled, the XSLT document() function can still read any URI unless XSLTAccessControl is applied. This vulnerability allows remote attackers to gain read-only access to any file the LangChain process can reach, including sensitive files such as SSH keys, environment files, source code, or cloud metadata. No authentication, special privileges, or user interaction are required, and the issue is exploitable in default deployments that enable custom XSLT.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-06

Last Modified

2025-10-08

Generated

2026-07-06

AI Q&A

2025-10-06

EPSS Evaluated

2026-07-05

NVD

CVE-2025-6985

Affected Vendors & Products

Vendor	Product	Version / Range
lxml	lxml	5.0
langchain	langchain-text-splitters	0.3.8
lxml	lxml	4.9

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the HTMLSectionSplitter class of langchain-text-splitters version 0.3.8, which uses unsafe XSLT parsing. It allows attackers to exploit XML External Entity (XXE) attacks by using arbitrary XSLT stylesheets parsed without security hardening. This leads to the resolution of external entities by default in certain lxml versions, enabling attackers to read arbitrary local files or perform outbound HTTP(S) requests. Essentially, attackers can remotely read any file accessible to the LangChain process without authentication or special privileges.

Impact Analysis

The vulnerability can impact you by allowing remote attackers to gain unauthorized read-only access to any file that the LangChain process can access. This includes sensitive files such as SSH keys, environment configuration files, source code, or cloud metadata. Since no authentication or user interaction is required, attackers can exploit this in default deployments that enable custom XSLT, potentially leading to information disclosure and security breaches.

Hi! I’m here to help you understand CVE-2025-6985. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70