{"id":"CVE-2025-46726","aliases":["GHSA-pw95-88fg-3j6f","PYSEC-2026-1532"],"title":"Langroid Allows XXE Injection via XMLToolMessage","summary":"Langroid Allows XXE Injection via XMLToolMessage","severity":"high","vendor":"langroid","product":"langroid","ecosystem":"pip","affected":["langroid < 0.53.4"],"patched":["langroid 0.53.4"],"published":"2025-05-05","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pw95-88fg-3j6f","references":[{"url":"https://github.com/langroid/langroid/security/advisories/GHSA-pw95-88fg-3j6f"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46726"},{"url":"https://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3"},{"url":"https://github.com/langroid/langroid"},{"url":"https://github.com/langroid/langroid/blob/df6227e6c079ec22bb2768498423148d6685acff/langroid/agent/xml_tool_message.py#L51-L52"}],"tags":["osv","pip"],"epss":0.00621,"epssPercentile":0.48448,"ingestedAt":"2026-07-08T18:25:52.023Z","slug":"CVE-2025-46726","body":"## Overview\n\n### Summary\nA LLM application leveraging `XMLToolMessage` class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information.\n\n### Details\n`XMLToolMessage` uses `lxml` without safeguards:\nhttps://github.com/langroid/langroid/blob/df6227e6c079ec22bb2768498423148d6685acff/langroid/agent/xml_tool_message.py#L51-L52\n`lxml` is vulnerable to quadratic blowup attacks and processes external entity declarations for local files by default. \nCheck here: https://pypi.org/project/defusedxml/#python-xml-libraries\n\n### PoC\nA typical Quadratic blowup XML payload looks like this:\n```xml\n<!DOCTYPE bomb [\n<!ENTITY a \"aaaaaaaaaa\">\n<!ENTITY b \"&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;\">\n<!ENTITY c \"&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;\">\n]>\n<bomb>&c;</bomb>\n```\nHere, &a; expands to 10 characters, &b; expands to 100, and &c; expands to 1000, causing exponential memory usage and potentially crashing the application.\n \n### Fix\nLangroid 0.53.4 initializes `XMLParser` with flags to prevent XML External Entity (XXE), billion laughs, and external DTD attacks by disabling entity resolution, DTD loading, and network access.\nhttps://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3\n\n## Affected packages\n\n- `langroid < 0.53.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `langroid 0.53.4`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}