CVE-2024-1455Medium· 5.9▾ SunlitLangChain's XMLOutputParser vulnerable to XML Entity Expansion
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
The XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library which has some XML vulnerabilities; see: https://docs.python.org/3/library/xml.html
This primarily affects users that combine an LLM (or agent) with the XMLOutputParser and expose the component via an endpoint on a web-service.
This would allow a malicious party to attempt to manipulate the LLM to produce a malicious payload for the parser that would compromise the availability of the service.
A successful attack is predicated on:
langchain-core < 0.1.35Upgrade to a patched release:
langchain-core 0.1.35Connected by shared product, vendor, weakness, or advisory.
CVE-2026-44843High· 8.2LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists
CVE-2026-40087Medium· 5.3LangChain has incomplete f-string validation in prompt templates
CVE-2026-26013Low· 3.7LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages
CVE-2025-65106HighLangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates
CVE-2024-10940Medium· 5.3langchain-core allows unauthorized users to read arbitrary files from the host file system