{"record":{"id":"2e4760231170d610","repo":"langchain-ai/langchain","slug":"defusedxml-is-not-installed-please-install-it-to","errorCode":null,"errorMessage":"defusedxml is not installed. Please install it to use the defusedxml parser. You can install it with `pip install defusedxml`. See https://github.com/tiran/defusedxml for more details","messagePattern":"defusedxml is not installed\\. Please install it to use the defusedxml parser\\. You can install it with `pip install defusedxml`\\. See https://github\\.com/tiran/defusedxml for more details","errorType":"exception","errorClass":"ImportError","httpStatus":null,"severity":"error","filePath":"libs/core/langchain_core/output_parsers/xml.py","lineNumber":70,"sourceCode":"        Args:\n            parser: Parser to use for XML parsing.\n\n                Can be either `'defusedxml'` or `'xml'`. See documentation in\n                `XMLOutputParser` for more information.\n\n        Raises:\n            ImportError: If `defusedxml` is not installed and the `defusedxml` parser is\n                requested.\n        \"\"\"\n        if parser == \"defusedxml\":\n            if not _HAS_DEFUSEDXML:\n                msg = (\n                    \"defusedxml is not installed. \"\n                    \"Please install it to use the defusedxml parser. \"\n                    \"You can install it with `pip install defusedxml`. \"\n                    \"See https://github.com/tiran/defusedxml for more details\"\n                )\n                raise ImportError(msg)\n            parser_ = XMLParser(target=TreeBuilder())\n        else:\n            parser_ = None\n        self.pull_parser = ET.XMLPullParser([\"start\", \"end\"], _parser=parser_)\n        self.xml_start_re = re.compile(r\"<[a-zA-Z:_]\")\n        self.current_path: list[str] = []\n        self.current_path_has_children = False\n        self.buffer = \"\"\n        self.xml_started = False\n\n    def parse(self, chunk: str | BaseMessage) -> Iterator[AddableDict]:\n        \"\"\"Parse a chunk of text.\n\n        Args:\n            chunk: A chunk of text to parse. This can be a `str` or a `BaseMessage`.\n\n        Yields:\n            A `dict` representing the parsed XML element.","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/langchain-ai/langchain/blob/e32fa9a52eab3b61ad7a45399bfde59b3e580fc4/libs/core/langchain_core/output_parsers/xml.py#L52-L88","documentation":"ImportError raised in _StreamingParser.__init__ when parser='defusedxml' is requested but the optional defusedxml package is not installed. The streaming XML parser needs defusedxml's XMLParser to protect against entity-expansion and other XML attacks, so it refuses to fall back silently to the unsafe stdlib parser.","triggerScenarios":"Constructing XMLOutputParser(parser='defusedxml') (the default) in an environment where defusedxml is not installed — langchain-core does not depend on it unconditionally.","commonSituations":"Deploying to slim containers/lambda images that installed langchain-core without the xml extra; upgrading langchain versions where the optional dependency was pruned from the lockfile.","solutions":["Install defusedxml: pip install defusedxml (or add it to your project dependencies)","If you intentionally parse fully trusted input only, construct XMLOutputParser with the standard-library parser option instead of parser='defusedxml'","Pin defusedxml in requirements/uv.lock so CI and prod match"],"exampleFix":"# before (ImportError at runtime)\nparser = XMLOutputParser(parser=\"defusedxml\")\n\n# after\n# shell: pip install defusedxml\nparser = XMLOutputParser(parser=\"defusedxml\")  # now works","handlingStrategy":"validation","validationCode":"import importlib.util\nif parser_name == \"defusedxml\" and importlib.util.find_spec(\"defusedxml\") is None:\n    raise ImportError(\"install defusedxml before using the defusedxml XML parser\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add defusedxml to project dependencies when using XMLOutputParser","Check optional dependencies at application startup, not at parse time"],"tags":["xml","dependencies","security","import-error"],"backgroundTag":null,"analyzedSha":"e32fa9a52eab3b61ad7a45399bfde59b3e580fc4","analyzedAt":"2026-08-14T18:42:09.092Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}