Search for packages
| purl | pkg:pypi/langflow@1.0.18 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1s44-7dfe-c7bq
Aliases: CVE-2024-9277 GHSA-355v-2rjx-fpx7 |
There are no reported fixed by versions. | |
|
VCID-22hm-534x-fyed
Aliases: CVE-2026-33873 GHSA-v8hw-mh8c-jxfc PYSEC-2026-82 |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue. |
Affected by 0 other vulnerabilities. |
|
VCID-9vte-9ecr-quhw
Aliases: CVE-2026-33497 GHSA-ph9w-r52h-28p7 PYSEC-2026-81 |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not strictly filtered, which allows the secret_key to be read across directories. Version 1.7.1 contains a patch. |
Affected by 4 other vulnerabilities. |
|
VCID-dsgg-w6zh-5fek
Aliases: CVE-2026-33053 GHSA-rf6x-r45m-xv3w PYSEC-2026-78 |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion. |
Affected by 4 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-h5t6-zh8q-nkhh
Aliases: CVE-2025-3248 GHSA-rvqx-wpfh-mfx7 PYSEC-2025-36 |
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. |
Affected by 7 other vulnerabilities. |
|
VCID-quy8-3rhy-wufd
Aliases: CVE-2025-68478 GHSA-f43r-cc68-gpx4 PYSEC-2025-125 |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is. Version 1.7.0 fixes the issue. |
Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. |
|
VCID-uewy-ce1y-z3hg
Aliases: CVE-2024-48061 GHSA-5p5r-57fx-pmfr |
There are no reported fixed by versions. | |
|
VCID-uqbp-kmed-fyc8
Aliases: CVE-2025-34291 GHSA-577h-p2hh-v4mv PYSEC-2025-78 |
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. An attacker-controlled origin can therefore obtain fresh access_token / refresh_token pairs for a victim session. Obtained tokens permit access to authenticated endpoints — including built-in code-execution functionality — allowing the attacker to execute arbitrary code and achieve full system compromise. |
Affected by 5 other vulnerabilities. |
|
VCID-z1h6-t53p-77aj
Aliases: CVE-2026-33484 GHSA-7grx-3xcx-2xv5 PYSEC-2026-80 |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||