Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2025-46726

Langroid Vulnerable to XXE Injection via XMLToolMessage

Description

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.53.4, a LLM application leveraging `XMLToolMessage` class may be exposed to untrusted XML input that could result in DoS and/or exposing local files with sensitive information. Version 0.53.4 fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

langroid langroid

  • < 0.53.4affected

References