{"action":"Upgrade langroid to 0.53.4 or later.","affected":[{"fixed":"0.53.4","introduced":"0"}],"component":"langroid","cve_ids":["CVE-2025-46726"],"ecosystem":"PyPI","epss":0.00648,"exploited":false,"fixed_versions":["0.53.4"],"ghsa_id":"GHSA-pw95-88fg-3j6f","id":"tcs_01M5KFTTYQRCH081JGFDA7QED1","modified_at":"2026-07-07T17:56:21.504962580Z","published_at":"2025-05-05T20:40:44Z","references":["https://osv.dev/vulnerability/GHSA-pw95-88fg-3j6f","https://github.com/langroid/langroid/security/advisories/GHSA-pw95-88fg-3j6f","https://nvd.nist.gov/vuln/detail/CVE-2025-46726","https://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3","https://github.com/langroid/langroid","https://github.com/langroid/langroid/blob/df6227e6c079ec22bb2768498423148d6685acff/langroid/agent/xml_tool_message.py#L51-L52"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-pw95-88fg-3j6f","url":"https://osv.dev/vulnerability/GHSA-pw95-88fg-3j6f"},{"source":"nvd","source_id":"CVE-2025-46726","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-46726"}],"summary":"Langroid Allows XXE Injection via XMLToolMessage"}