7.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6985

CVE-2025-6985: LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing

The HTMLSectionSplitter class in langchain-text-splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing. This vulnerability arises because the class allows the use of arbitrary XSLT stylesheets, which are parsed using lxml.etree.parse() and lxml.etree.XSLT() without any hardening measures. In lxml versions up to 4.9.x, external entities are resolved by default, allowing attackers to read arbitrary local files or perform outbound HTTP(S) fetches. In lxml versions 5.0 and above, while entity expansion is disabled, the XSLT document() function can still read any URI unless XSLTAccessControl is applied. This vulnerability allows remote attackers to gain read-only access to any file the LangChain process can reach, including sensitive files such as SSH keys, environment files, source code, or cloud metadata. No authentication, special privileges, or user interaction are required, and the issue is exploitable in default deployments that enable custom XSLT.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6985

CVE-2025-6985:

7.5

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
langchain-text-splitters	pip	< 1.0.0a1	1.0.0a1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic XML External Entity (XXE) injection within the HTMLSectionSplitter class of the langchain-text-splitters library. The vulnerability existed due to a combination of two factors:

User-Controlled Input: The HTMLSectionSplitter.__init__ method accepted an xslt_path parameter, allowing an attacker to specify the location of an XSLT stylesheet. This served as the injection vector.
Unsafe Parsing: The HTMLSectionSplitter.convert_possible_tags_to_header method used lxml.etree.parse() to process the stylesheet from the provided path. This parsing was done without any security hardening, meaning external entities within a malicious XSLT file would be resolved. This could be exploited to read sensitive files from the local system or initiate server-side requests (SSRF).

An attacker could exploit this by instantiating HTMLSectionSplitter with a path to a crafted malicious XSLT file and then calling a method like split_text or split_documents, which in turn calls the vulnerable convert_possible_tags_to_header function.

The patch effectively mitigates this vulnerability through two main changes:

Removing the Attack Vector: The xslt_path parameter was removed from the constructor, forcing the class to use a hardcoded, trusted default XSLT file. This eliminates the ability for an attacker to supply a malicious file.
Defense-in-Depth: As a secondary protection, the XML and XSLT parsers were hardened by explicitly disabling network access, entity resolution, and DTD loading, and by applying a strict access control policy. This ensures that even if an attacker found another way to control the XSLT content, the parser would not process dangerous entities or access external resources.

Therefore, the functions HTMLSectionSplitter.__init__ and HTMLSectionSplitter.convert_possible_tags_to_header are the key indicators of this vulnerability, as one provides the entry point and the other performs the unsafe operation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.