Vulnerability record · CVE-2025-57809 · published 25 August 2025

CVE-2025-57809: Mlc-ai xgrammar vulnerability

MMlc Ai · Xgrammar

XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.21, XGrammar has an infinite recursion issue in the grammar. This issue has been resolved in version 0.1.21.

7.7 CVSS 4.0 High EPSS 0.47% · top 62.2% CWE-674 · CWE-674

7.7CVSS 4.0 base score

0.47%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

MXgrammar Mlc Ai

References

Link	Tags
https://github.com/mlc-ai/xgrammar/commit/b943feacb5a1caf4d39de8ec3bf7c7ce066dcee5	Patch
https://github.com/mlc-ai/xgrammar/issues/250	ExploitIssue Tracking
https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-5cmr-4px5-23pc	Vendor Advisory

Track CVE-2025-57809 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-25048Mlc-ai xgrammar vulnerabilityxgrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to version 0.1.32, the multi-level nested synta…EPSS 0.71%5 Mar 2026 6.9CVE-2025-58446Mlc-ai xgrammar allocation without limits vulnerabilityxgrammar is an open-source library for efficient, flexible, and portable structured generation. A grammar optimizer introduced in 0.1.23 processes la…EPSS 0.53%6 Sep 2025 6.5CVE-2025-32381Mlc-ai xgrammar allocation without limits vulnerabilityXGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compil…EPSS 0.50%9 Apr 2025

Source: NIST National Vulnerability Database (record CVE-2025-57809), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.