langflow
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 84 advisory(ies) without a verdict
Advisories (84)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-355v-2rjx-fpx7 Inefficient Regular Expression Complexity in langflow | ≤ 1.0.18 | Undetermined |
| GHSA-3645-fxcv-hqr4 Langflow has Remote Code Execution in CSV Agent | ≤ 1.8.0rc2 | Undetermined |
| GHSA-4f6c-2vvp-gw82 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write | 1.5.0 – < 1.10.3 | Undetermined |
| GHSA-4gv9-mp8m-592r Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) | < 1.5.1 | Undetermined |
| GHSA-4hmc-cfm3-w43c Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers | 1.6.8 – < 1.9.1 | Undetermined |
| GHSA-56m6-4mhw-h3g5 langflow has vulnerability in PythonCodeTool component | ≤ 1.0.12 | Undetermined |
| GHSA-577h-p2hh-v4mv Langflow CORS misconfiguration enables Account Takeover and RCE | < 1.7.0 | Undetermined |
| GHSA-5993-7p27-66g5 Langflow vulnerable to Server-Side Request Forgery | < 1.7.1 | Undetermined |
| GHSA-5jjf-wcvf-923w Langflow has an Information Leak through Incomplete API Key Redaction | ≤ 1.8.3 | Undetermined |
| GHSA-5p5r-57fx-pmfr Langflow vulnerable to remote code execution | ≤ 1.0.18 | Undetermined |
| GHSA-79ph-745m-6wxq Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint | < 1.9.0 | Undetermined |
| GHSA-7grx-3xcx-2xv5 langflow has Unauthenticated IDOR on Image Downloads | 1.0.0 – < 1.9.0 | Undetermined |
| GHSA-7hw8-6q6r-4276 Langflow: Logout button does not clear session | < 1.7.0 | Undetermined |
| GHSA-8c4j-f57c-35cf Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check | < 1.5.1 | Undetermined |
| GHSA-8qpj-27x8-pwpq Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation | < 1.10.1 | Undetermined |
| GHSA-9c59-2mvc-vfr8 Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints | < 1.9.0 | Undetermined |
| GHSA-9fpm-3445-2vx4 Langflow: Prompt injection in Langflow Smart Transform can lead to code execution | 1.3.0 – < 1.10.3 | Undetermined |
| GHSA-9jpj-cph8-w449 Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint | < 1.9.1 | Undetermined |
| GHSA-9whx-c884-c68q Langflow Knowledge Bases API is Vulnerable to Path Traversal | < 1.9.0 | Undetermined |
| GHSA-c5cp-vx83-jhqx Langflow Missing Authentication on Critical API Endpoints | < 1.7.1 | Undetermined |
| GHSA-ccv6-r384-xp75 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit | < 1.9.2 | Undetermined |
| GHSA-cf6m-vc3m-7cgm Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass | 1.7.0 – < 1.9.1 | Undetermined |
| GHSA-f43r-cc68-gpx4 External Control of File Name or Path in Langflow | < 1.7.1 | Undetermined |
| GHSA-g22f-v6f7-2hrh Langflow affected by Remote Code Execution via validate_code() exec() | ≤ 1.7.3 | Undetermined |
| GHSA-g2j9-7rj2-gm6c Langflow has an Arbitrary File Write (RCE) via v2 API | 1.2.0 – < 1.9.0 | Undetermined |
| GHSA-gh98-4phw-6fmw Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints | 1.0.0 – < 1.10.1 | Undetermined |
| GHSA-j8f7-x8jm-wmm4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling) | < 1.10.3 | Undetermined |
| GHSA-jxw3-mjmx-3pqm Langflow: Weak Fernet Key via random.seed() | < 1.10.1 | Undetermined |
| GHSA-ph9w-r52h-28p7 langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading | < 1.7.1 | Undetermined |
| GHSA-qg33-x2c5-6p44 Langflow remote code execution vulnerability | < 1.0.15 | Undetermined |
| GHSA-qrpv-q767-xqq2 Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow | < 1.9.1 | Undetermined |
| GHSA-qwqc-p3q8-wcg9 Langflow: Unauthenticated DoS through multipart form boundary file upload | < 1.0.19 | Undetermined |
| GHSA-rcjh-r59h-gq37 Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read | < 1.10.0 | Undetermined |
| GHSA-rf6x-r45m-xv3w Langflow is Missing Ownership Verification in API Key Deletion (IDOR) | < 1.9.0 | Undetermined |
| GHSA-rvqx-wpfh-mfx7 Langflow Unauth RCE | < 1.3.0 | Undetermined |
| GHSA-v5ff-9q35-q26f Langflow: Unauthenticated RCE in Shareable Playgrounds | < 1.9.2 | Undetermined |
| GHSA-v66p-f7x3-4794 Langflow vulnerable to injection | ≤ 1.8.3 | Undetermined |
| GHSA-v798-mcc6-2m3m Langflow: Code Injection Vulnerability in Code Validation Endpoint | 1.0.0 – < 1.10.1.rc0 | Undetermined |
| GHSA-v8hw-mh8c-jxfc Langflow has Authenticated Code Execution in Agentic Assistant Validation | < 1.9.0 | Undetermined |
| GHSA-vwmf-pq79-vjvx Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint | < 1.9.0 | Undetermined |
| GHSA-w584-2h2r-2hvf Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description | 1.7.2 – < 1.10.1 | Undetermined |
| GHSA-w794-rj3p-xv45 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | 1.1.2 – < 1.10.3 | Undetermined |
| GHSA-x223-p2gf-v735 Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak | < 1.9.1 | Undetermined |
| PYSEC-2024-177 Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python scri | < 1.0.0a3 | Undetermined |
| PYSEC-2024-279 langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. | ≤ 1.0.12 | Undetermined |
| PYSEC-2025-125 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, if an arbitrary path is specified in the request body's ` | < 1.7.0 | Undetermined |
| PYSEC-2025-243 Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authe | < 1.5.0 | Undetermined |
| PYSEC-2025-36 Langflow versions prior to 1.3.0 are susceptible to code injection in | < 1.3.0 | Undetermined |
| PYSEC-2025-78 Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS c | < 1.7.0 | Undetermined |
| PYSEC-2026-1521 Inefficient Regular Expression Complexity in langflow | ≤ 1.0.18 | Undetermined |
| PYSEC-2026-1522 Langflow vulnerable to Server-Side Request Forgery | < 1.7.1 | Undetermined |
| PYSEC-2026-1523 Langflow vulnerable to remote code execution | ≤ 1.0.18 | Undetermined |
| PYSEC-2026-1524 Langflow Missing Authentication on Critical API Endpoints | < 1.7.1 | Undetermined |
| PYSEC-2026-1525 Langflow affected by Remote Code Execution via validate_code() exec() | ≤ 1.7.3 | Undetermined |
| PYSEC-2026-221 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, an Insecure Direct Object Reference (IDOR) vulnerability in /api/ | < 1.9.2 | Undetermined |
| PYSEC-2026-222 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.7.0, the logout button does not clear the session. The previous user s | < 1.7.0 | Undetermined |
| PYSEC-2026-223 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any | < 1.0.19 | Undetermined |
| PYSEC-2026-224 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server | < 1.9.1 | Undetermined |
| PYSEC-2026-242 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perfor | < 1.9.0 | Undetermined |
| PYSEC-2026-243 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a | < 1.9.2 | Undetermined |
| PYSEC-2026-244 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.10.0, the "Shareable Playground" (or "Public Flows" in code) contains | < 1.10.0 | Undetermined |
| PYSEC-2026-2565 Langflow has an Information Leak through Incomplete API Key Redaction | ≤ 1.8.3 | Undetermined |
| PYSEC-2026-2566 Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint | < 1.9.0 | Undetermined |
| PYSEC-2026-2567 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check | < 1.5.1 | Undetermined |
| PYSEC-2026-2568 Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint | < 1.9.1 | Undetermined |
| PYSEC-2026-2569 Langflow vulnerable to injection | ≤ 1.8.3 | Undetermined |
| PYSEC-2026-376 Langflow has Remote Code Execution in CSV Agent | ≤ 1.8.0rc2 | Undetermined |
| PYSEC-2026-377 Langflow Knowledge Bases API is Vulnerable to Path Traversal | < 1.9.0 | Undetermined |
| PYSEC-2026-378 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit | < 1.9.2 | Undetermined |
| PYSEC-2026-379 Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint | < 1.9.0 | Undetermined |
| PYSEC-2026-4229 Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write | 1.5.0 – < 1.10.3 | Undetermined |
| PYSEC-2026-4230 Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers | 1.6.8 – < 1.9.1 | Undetermined |
| PYSEC-2026-4231 Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation | < 1.10.1 | Undetermined |
| PYSEC-2026-4232 Langflow: Prompt injection in Langflow Smart Transform can lead to code execution | 1.3.0 – < 1.10.3 | Undetermined |
| PYSEC-2026-4233 Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass | 1.7.0 – < 1.9.1 | Undetermined |
| PYSEC-2026-4234 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints | 1.0.0 – < 1.10.1 | Undetermined |
| PYSEC-2026-4235 Langflow: Weak Fernet Key via random.seed() | < 1.10.1 | Undetermined |
| PYSEC-2026-4236 Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description | 1.7.2 – < 1.10.1 | Undetermined |
| PYSEC-2026-4237 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | 1.1.2 – < 1.10.3 | Undetermined |
| PYSEC-2026-78 Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_ke | < 1.9.0 | Undetermined |
| PYSEC-2026-79 Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (Exter | 1.2.0 – < 1.9.0 | Undetermined |
| PYSEC-2026-80 Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` | 1.0.0 – < 1.9.0 | Undetermined |
| PYSEC-2026-81 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_ | < 1.7.1 | Undetermined |
| PYSEC-2026-82 Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-ge | < 1.9.0 | Undetermined |
Withdrawn advisories (5)
Withdrawn by their publisher: they affect no version and are not counted above.
- GHSA-9cc5-j3qq-69gv Duplicate Advisory: Unauthenticated Flow Execution via Webhook Authentication Bypass · withdrawn
- GHSA-9pw3-x84f-xcwf Duplicate Advisory: Langflow: Weak Fernet Key via random.seed() · withdrawn
- GHSA-c995-4fw3-j39m Duplicate Advisory: Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint · withdrawn
- GHSA-hhxr-7j22-694r Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution · withdrawn
- GHSA-qqw9-2vj9-hx7r Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description · withdrawn
Sources
| Source | Licence |
|---|