---
id: CVE-2025-6984
title: 'langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)'
summary: >-
  An XML External Entity flaw has been discovered in the langchain-community
  python package. The EverNoteLoader component has an insecure use of the
  `etree.iterparse()` function which does not disable external entity
  references. This can lea…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe: CWE-200
vendor: Red Hat
product: Red Hat Ansible Automation Platform 2.5 for RHEL 8
affected:
  - openshift_lightspeed
  - ansible_automation_platform_2_5_for_rhel 8
patched:
  - ansible_automation_platform_2_5_for_rhel 8
published: '2025-09-04'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T10:42:14+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6984.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6984.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-6984'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2393073'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-6984'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6984'
  - url: >-
      https://github.com/langchain-ai/langchain-community/commit/e842452108089524e22c3a2ced851c021884556f
  - url: 'https://huntr.com/bounties/a6b521cf-258c-41c0-9edb-d8ef976abb2a'
  - url: 'https://access.redhat.com/errata/RHSA-2025:16514'
  - url: 'https://github.com/langchain-ai/langchain-community'
  - url: >-
      https://github.com/langchain-ai/langchain/blob/d79b5813a0b3b243c612b77013768995e46c4337/libs/langchain/langchain/document_loaders/evernote.py#L1-L23
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.01647
epssPercentile: 0.76345
aliases:
  - GHSA-pc6w-59fv-rh23
  - PYSEC-2026-1515
ecosystem: pip
ingestedAt: '2026-07-08T18:25:51.746Z'
---

## Overview

An XML External Entity flaw has been discovered in the langchain-community python package. The EverNoteLoader component has an insecure use of the `etree.iterparse()` function which does not disable external entity references. This can lead to sensitive information disclosure. An attacker could exploit this by crafting a malicious XML payload that references local files, potentially exposing sensitive data

## Vendor advisories

- **RHSA-2025:16514** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8 · released 2025-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2025:16514)
- **Red Hat VEX** · Important · affected: OpenShift Lightspeed · no fix planned: OpenShift Lightspeed · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-6984.json)

**langchain-community: Langchain-community insecure XML parsing** — rated Important by Red Hat. Released 2025-09-04, updated 2026-10-15.

Affected:

- OpenShift Lightspeed

Fixed:

- Red Hat Ansible Automation Platform 2.5 for RHEL 8

No fix planned:

- OpenShift Lightspeed

Not affected:

- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux AI (RHEL AI)

## Remediation

Red Hat Ansible Automation Platform https://access.redhat.com/errata/RHSA-2025:16514

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2025-6984)

Affected packages:

- `langchain-community < 0.3.27`

Patched in:

- `langchain-community 0.3.27`

Source: https://osv.dev/vulnerability/GHSA-pc6w-59fv-rh23