Lookup for vulnerable packages by Package URL.
| Purl | pkg:pypi/langflow@0.6.5a12 |
|---|
| Type | pypi |
|---|
| Namespace | |
|---|
| Name | langflow |
|---|
| Version | 0.6.5a12 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 1.9.0 |
|---|
| Latest_non_vulnerable_version | 1.9.0 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-ef87-295y-zbha |
| vulnerability_id |
VCID-ef87-295y-zbha |
| summary |
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-37014, PYSEC-2024-177
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ef87-295y-zbha |
|
| 1 |
| url |
VCID-ncvf-vzqr-uydz |
| vulnerability_id |
VCID-ncvf-vzqr-uydz |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33497, GHSA-ph9w-r52h-28p7, PYSEC-2026-81
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ncvf-vzqr-uydz |
|
| 2 |
| url |
VCID-q4r1-xjfk-7bg9 |
| vulnerability_id |
VCID-q4r1-xjfk-7bg9 |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33053, GHSA-rf6x-r45m-xv3w, PYSEC-2026-78
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q4r1-xjfk-7bg9 |
|
| 3 |
| url |
VCID-sbea-kkfu-akgb |
| vulnerability_id |
VCID-sbea-kkfu-akgb |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Version 1.7.0 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-68478, GHSA-f43r-cc68-gpx4, PYSEC-2025-125
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sbea-kkfu-akgb |
|
| 4 |
| url |
VCID-v5pc-pdm9-97g8 |
| vulnerability_id |
VCID-v5pc-pdm9-97g8 |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-33873, GHSA-v8hw-mh8c-jxfc, PYSEC-2026-82
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-v5pc-pdm9-97g8 |
|
| 5 |
| url |
VCID-wv26-29b9-vqgg |
| vulnerability_id |
VCID-wv26-29b9-vqgg |
| summary |
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-3248, PYSEC-2025-36
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wv26-29b9-vqgg |
|
| 6 |
| url |
VCID-ysnc-jyxb-6qcy |
| vulnerability_id |
VCID-ysnc-jyxb-6qcy |
| summary |
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-34291, GHSA-577h-p2hh-v4mv, PYSEC-2025-78
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ysnc-jyxb-6qcy |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:pypi/langflow@0.6.5a12 |
|---|