Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/langflow@1.10.3
purl pkg:pypi/langflow@1.10.3
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 2.9
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-qqw9-2vj9-hx7r

Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description ## Duplicate Advisory This advisory has been … There are no reported fixed by versions.
GHSA-hhxr-7j22-694r

Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution ## Duplicate Advisory This advisory has been … There are no reported fixed by versions.
Vulnerabilities fixed by this package (4)

Advisory Summary Aliases
GHSA-j8f7-x8jm-wmm4
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, …
PYSEC-2026-4229
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write **Description**: ### Summary An IP spoofing vulnerability in the Model … CVE-2026-105741
GHSA-4f6c-2vvp-gw82
PYSEC-2026-4232
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution ## Summary Langflow versions 1.3.0 through 1.10.2 contain … CVE-2026-7700
GHSA-9fpm-3445-2vx4
PYSEC-2026-4237
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration ### Summary Before **Langflow 1.10.3**, the MCP … CVE-2026-105697
GHSA-w794-rj3p-xv45
PYSEC-2026-4239
PYSEC-2026-4241