Search for packages
| purl | pkg:pypi/langflow@1.8.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-22hm-534x-fyed
Aliases: CVE-2026-33873 GHSA-v8hw-mh8c-jxfc PYSEC-2026-82 |
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue. |
Affected by 1 other vulnerability. |
|
VCID-3kr1-vtdc-43hb
Aliases: CVE-2026-6598 GHSA-9jpj-cph8-w449 |
Affected by 0 other vulnerabilities. |
|
|
VCID-cf4w-2j9d-kqee
Aliases: CVE-2026-33017 GHSA-vwmf-pq79-vjvx |
There are no reported fixed by versions. | |
|
VCID-dsgg-w6zh-5fek
Aliases: CVE-2026-33053 GHSA-rf6x-r45m-xv3w PYSEC-2026-78 |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_key_id path parameter and deletes it with only a generic authentication check (get_current_active_user dependency). However, the delete_api_key() CRUD function does NOT verify that the API key belongs to the current user before deletion. |
Affected by 1 other vulnerability. |
|
VCID-e43u-exka-akh6
Aliases: CVE-2026-6597 GHSA-5jjf-wcvf-923w |
Affected by 6 other vulnerabilities. |
|
|
VCID-f48g-ys3e-kfbe
Aliases: CVE-2026-6599 GHSA-v66p-f7x3-4794 |
Affected by 6 other vulnerabilities. |
|
|
VCID-rnzn-x922-vkav
Aliases: CVE-2026-33309 GHSA-g2j9-7rj2-gm6c PYSEC-2026-79 |
Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix. |
Affected by 1 other vulnerability. |
|
VCID-z1h6-t53p-77aj
Aliases: CVE-2026-33484 GHSA-7grx-3xcx-2xv5 PYSEC-2026-80 |
Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated request with a known flow_id and file_name returns the image with HTTP 200. In a multi-tenant deployment, any attacker who can discover or guess a `flow_id` (UUIDs can be leaked through other API responses) can download any user's uploaded images without credentials. Version 1.9.0 contains a patch. |
Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||