| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-4swq-hbjm-3ucd |
| vulnerability_id |
VCID-4swq-hbjm-3ucd |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33484, GHSA-7grx-3xcx-2xv5, PYSEC-2026-80
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4swq-hbjm-3ucd |
|
| 1 |
| url |
VCID-ncvf-vzqr-uydz |
| vulnerability_id |
VCID-ncvf-vzqr-uydz |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33497, GHSA-ph9w-r52h-28p7, PYSEC-2026-81
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ncvf-vzqr-uydz |
|
| 2 |
| url |
VCID-q4r1-xjfk-7bg9 |
| vulnerability_id |
VCID-q4r1-xjfk-7bg9 |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33053, GHSA-rf6x-r45m-xv3w, PYSEC-2026-78
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q4r1-xjfk-7bg9 |
|
| 3 |
| url |
VCID-sbea-kkfu-akgb |
| vulnerability_id |
VCID-sbea-kkfu-akgb |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Version 1.7.0 fixes the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-68478, GHSA-f43r-cc68-gpx4, PYSEC-2025-125
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sbea-kkfu-akgb |
|
| 4 |
| url |
VCID-v5pc-pdm9-97g8 |
| vulnerability_id |
VCID-v5pc-pdm9-97g8 |
| summary |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-33873, GHSA-v8hw-mh8c-jxfc, PYSEC-2026-82
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-v5pc-pdm9-97g8 |
|
| 5 |
| url |
VCID-wv26-29b9-vqgg |
| vulnerability_id |
VCID-wv26-29b9-vqgg |
| summary |
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-3248, PYSEC-2025-36
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wv26-29b9-vqgg |
|
| 6 |
| url |
VCID-ysnc-jyxb-6qcy |
| vulnerability_id |
VCID-ysnc-jyxb-6qcy |
| summary |
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-34291, GHSA-577h-p2hh-v4mv, PYSEC-2025-78
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ysnc-jyxb-6qcy |
|
|
|---|