Search for packages
| purl | pkg:pypi/langflow@1.10.2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-j8f7-x8jm-wmm4
|
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, … |
Vulnerable |
|
GHSA-qqw9-2vj9-hx7r
|
Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-hhxr-7j22-694r
|
Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
PYSEC-2026-4229
Aliases: CVE-2026-105741 GHSA-4f6c-2vvp-gw82 |
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write **Description**: ### Summary An IP spoofing vulnerability in the Model … |
Vulnerable |
|
PYSEC-2026-4232
Aliases: CVE-2026-7700 GHSA-9fpm-3445-2vx4 |
Langflow: Prompt injection in Langflow Smart Transform can lead to code execution ## Summary Langflow versions 1.3.0 through 1.10.2 contain … |
Vulnerable |
|
PYSEC-2026-4237
Aliases: CVE-2026-105697 GHSA-w794-rj3p-xv45 PYSEC-2026-4239 PYSEC-2026-4241 |
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration ### Summary Before **Langflow 1.10.3**, the MCP … |
Vulnerable |