The langchain-text-splitters library contains an XXE vulnerability in its HTMLSectionSplitter class that allows unauthenticated remote attackers to read arbitrary files from the host system.

The vulnerability stems from improper restriction of XML External Entity references within the HTMLSectionSplitter class, which processes XSLT stylesheets using unsanitized lxml calls. Because the library fails to apply hardening measures, an unauthenticated remote attacker can force the application to read sensitive local files, including SSH keys and cloud metadata.

The ability to read arbitrary files from the server environment poses a severe risk to organizational security, as it facilitates the exfiltration of credentials, source code, and environment variables. With a CVSS score of 7.5, this high-severity flaw enables attackers to escalate their access or move laterally within the infrastructure. Continued exposure could lead to full system compromise or significant data breaches.

Immediate Action: Since no specific patch version is currently identified, audit all codebases to identify usage of the HTMLSectionSplitter class and restrict its use to trusted inputs only until a vendor-supplied update is available.

Proactive Monitoring: Monitor application logs and network traffic for unusual outbound HTTP requests originating from the application server, which may indicate attempted exfiltration via the XSLT document function.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block malicious XML payloads, and ensure the application process is running with the principle of least privilege to minimize the impact of file system access.

Public Exploit Available: No (Exploit available: unknown)

Given the potential for unauthorized access to sensitive system files, this vulnerability should be treated with high priority. Organizations utilizing LangChain should track security bulletins for updates to the langchain-text-splitters package and apply patches immediately upon release. In the interim, strictly sanitize or disable any functionality that processes external or untrusted XSLT content.