1  info:
 2    name: langchain
 3    cve: CVE-2024-1455
 4    summary: LangChain's XMLOutputParser vulnerable to XML Entity Expansion
 5    details: |
 6      The XMLOutputParser in LangChain uses the etree module from the XML parser in the standard python library, which has some XML vulnerabilities.
 7      This primarily affects users that combine an LLM (or agent) with the `XMLOutputParser` and expose the component via an endpoint on a web-service. A successful attack is predicated on:
 8      1. Usage of XMLOutputParser
 9      2. Passing of malicious input into the XMLOutputParser either directly or by trying to manipulate an LLM to do so on the users behalf
10      3. Exposing the component via a web-service
11    cvss: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
12    severity: MEDIUM
13    security_advise: |
14      1. Upgrade to langchain-core>=0.1.35
15      2. Avoid exposing the XMLOutputParser component via web-services
16      3. Implement input validation to prevent malicious XML input
17  rule: version >= "0" && version < "0.1.35"
18  references:
19    - https://nvd.nist.gov/vuln/detail/CVE-2024-1455
20    - https://github.com/langchain-ai/langchain/pull/17250
21    - https://github.com/langchain-ai/langchain/pull/19653
22    - https://github.com/langchain-ai/langchain/pull/19660
23    - https://github.com/langchain-ai/langchain/commit/727d5023ce88e18e3074ef620a98137d26ff92a3
24    - https://github.com/langchain-ai/langchain
25    - https://huntr.com/bounties/4353571f-c70d-4bfd-ac08-3a89cecb45b6