CVE-2025-6984

Advisory

Affected versions of the langchain-community package are vulnerable to XML External Entity (XXE) Injection due to the use of `etree.iterparse` without disabling external entity resolution. ([GitHub][1]) The `langchain_community.document_loaders.evernote` module’s `EverNoteLoader` parses ENEX input with `etree.iterparse()` without a hardened XML parser, enabling expansion of external entities and unintended access to local resources.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-pc6w-59fv-rh23
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6984