langchain-ai langchain - XML External Entity Injection
langchain-ai/langchain 0.3.63 contains an XML External Entity (XXE) injection caused by insecure XML parsing in EverNoteLoader using etree.iterparse(), letting attackers disclose sensitive information, exploit requires crafted malicious XML payload.
LangChain CommunityPoC 已收录
CVSS—