EUVD-2026-16666
GHSA-89f7-r7x8-83q7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionCVE.org
The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.
Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.
AnalysisAI
Stored XSS in Langflow's image serving endpoint allows authenticated attackers to steal session tokens via malicious SVG uploads. The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves user-uploaded SVG files with 'image/svg+xml' content type without sanitization, enabling embedded JavaScript execution in victim browsers. Authenticated attackers with low privileges can upload crafted SVGs that execute in other users' contexts, exfiltrating JWT access and refresh tokens from cookies. EPSS probability is low (0.07%, 22nd percentile) with no active exploitation confirmed (SSVC: none), but the attack is straightforward for authenticated users with file upload permissions.
Technical ContextAI
This vulnerability stems from improper neutralization of input during web page generation (CWE-79), specifically stored cross-site scripting. SVG (Scalable Vector Graphics) files are XML-based vector images that can contain embedded scripts within <script> tags or event handlers. When served with the 'image/svg+xml' MIME type and rendered inline in browsers, these scripts execute in the origin's security context. Langflow's file serving API endpoint lacks content security policies (CSP), SVG sanitization (stripping <script> tags, event handlers, and data URIs), or safe content-type headers (text/plain or application/octet-stream for untrusted content). The affected product per CPE data is Langflow version unspecified ('langflow:-'), though EUVD lists 'langflow 0' which suggests early/initial versions. The CVSS 4.0 vector indicates network-based attack (AV:N), low complexity (AC:L), requiring low privileges (PR:L) and user interaction (UI:P), with high confidentiality impact (VC:H) and low integrity impact (VI:L) to the vulnerable system, no subsequent system compromise (SC:N/SI:N/SA:N).
RemediationAI
Apply vendor-released patch once available from the Langflow project repository (monitor https://github.com/langflow-ai/langflow for security updates and CVE-2026-5026 fix announcements). Primary mitigation is implementing SVG sanitization using libraries like DOMPurify or svg-sanitizer to strip script tags, event handlers, and unsafe attributes before serving files. Immediate compensating controls with trade-offs: (1) Modify endpoint to serve SVG files with 'Content-Type: text/plain' and 'Content-Disposition: attachment' headers, preventing browser rendering but breaking legitimate SVG display functionality in flows; (2) Implement Content Security Policy headers with 'default-src self; script-src self' to block inline scripts, though this may interfere with other Langflow features requiring inline JavaScript; (3) Restrict '/api/v1/files/images/' endpoint access to authenticated API calls only with anti-CSRF tokens, preventing direct browser navigation but requiring application-level changes; (4) Deploy Web Application Firewall rules to detect and block SVG uploads containing <script> tags or javascript: URIs, accepting risk of bypass via obfuscation techniques. For high-security environments, disable SVG upload support entirely if workflows don't require vector graphics, or proxy all image serving through a separate sanitization service. Review Tenable TRA-2026-25 for additional vendor-specific guidance: https://www.tenable.com/security/research/tra-2026-25.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today