CVE-2025-46726
📋 TL;DR
Langroid applications using the XMLToolMessage class with untrusted XML input are vulnerable to XML External Entity (XXE) attacks. This allows attackers to cause denial of service or read sensitive local files. All Langroid applications using XMLToolMessage with user-supplied XML before version 0.53.4 are affected.
💻 Affected Systems
- Langroid
📦 What is this software?
Langroid by Langroid
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through sensitive file disclosure (e.g., /etc/passwd, SSH keys, configuration files) leading to data exfiltration and potential lateral movement.
Likely Case
Denial of service through XML entity expansion attacks or limited file disclosure from accessible directories.
If Mitigated
Minimal impact if XML input is properly sanitized or restricted to trusted sources only.
🎯 Exploit Status
XXE vulnerabilities are well-understood with established exploitation patterns. No public exploit code has been released for this specific CVE.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.53.4
Vendor Advisory: https://github.com/langroid/langroid/security/advisories/GHSA-pw95-88fg-3j6f
Restart Required: Yes
Instructions:
1. Update Langroid to version 0.53.4 or later using pip: pip install --upgrade langroid>=0.53.4
2. Restart all Langroid applications
3. Verify the fix by checking the version
🔧 Temporary Workarounds
Disable XML external entities
allConfigure XML parser to disable external entity resolution
Modify XMLToolMessage usage to set resolve_entities=False in XML parser configuration
Input validation and sanitization
allValidate and sanitize all XML input before processing
Implement XML schema validation or strip DOCTYPE declarations from user input
🧯 If You Can't Patch
- Implement strict input validation to reject XML containing DOCTYPE declarations or external entity references
- Run Langroid applications with minimal file system permissions and in isolated containers
🔍 How to Verify
Check if Vulnerable:
Check if application uses XMLToolMessage class and processes untrusted XML. Review code for XMLToolMessage imports and usage.Check Version:
python -c "import langroid; print(langroid.__version__)"Verify Fix Applied:
Verify Langroid version is 0.53.4 or later and test with malicious XML containing XXE payloads to confirm they are rejected.📡 Detection & Monitoring
Log Indicators:
- XML parsing errors mentioning external entities
- Unusual file access patterns from Langroid processes
- High memory or CPU usage during XML processing
Network Indicators:
- Outbound connections to unexpected external domains during XML processing
- Large XML payloads being submitted to Langroid endpoints
SIEM Query:
source="langroid" AND (message="*DOCTYPE*" OR message="*ENTITY*" OR message="*external*" OR process_access="sensitive_file")