CVE-2025-46726 is a critical XML external entity flaw (CVSS 9.1) in Langroid before 0.53.4. A language model application that uses the XMLToolMessage class and receives untrusted XML may suffer denial of service or expose local files. Upgrade to 0.53.4, which hardens the XML parser.
What's affected
The NVD record says Langroid versions before 0.53.4 are affected, and the GitHub advisory names 0.53.4 as the patched release.
The affected class is XMLToolMessage. The advisory says it used the lxml parser with default settings, which process external entity declarations and are open to quadratic blowup attacks. The fix creates the parser with options that turn off entity resolution, DTD loading and network access.
How to check if you're exposed
Check the version and whether your application uses the class.
- Run
pip show langroidand read the Version line, or runpip freeze | grep -i langroid. - Search lock files with
grep -n langroid requirements.txt poetry.lock uv.lock. - Search your code with
grep -rn XMLToolMessage .to see whether any agent uses XML tool messages. - Check where the XML comes from. If model output or user text reaches the parser, treat the path as exposed.
Versions before 0.53.4 are in the affected range. The free in-browser dependency scan can read your dependency file in the browser and flag the version.
What to do now
- Upgrade Langroid to 0.53.4 or later, and preferably to a current release.
- Rebuild and redeploy images and serverless packages that pin the old version.
- Treat the XML that a model produces as untrusted input, since it can be influenced by prompts and by documents the model reads.
- Run the agent with a low privilege account, with no access to secret files and with limited memory, so that a failure stays contained.
- Add memory and time limits for XML parsing in your service.
- Check for the related Langroid advisory CVE-2025-46725, which is fixed in a later release.
Why it matters
The record lists CWE-611 (Improper Restriction of XML External Entity Reference). XML allows documents to define entities, which are shortcuts that the parser expands. Some entities can point to local files, and others can multiply in size until the parser runs out of memory. Parsers that follow those instructions by default open both doors.
The score of 9.1 reflects high confidentiality and availability impact with no login needed in the vector. In language model applications, the XML often comes from a model or a document, so the attack path can run through content that a user supplies indirectly. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
The demo shows how an inventory of your Python dependencies points to packages like Langroid, including ones pulled in indirectly.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
Langroid 0.53.4, according to the advisory.
Do I need to worry if I do not use XMLToolMessage?
The advisory concerns that class. If your code never uses it, the vulnerable parsing is likely not reachable, but upgrading is still sensible.
Sources
Last reviewed: 18 October 2026.
