EUVD-2026-23764Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
9DescriptionCVE.org
A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/chatMessage/components/edit-message.tsx of the component Frontend React Component Rendering. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Stored cross-site scripting (XSS) in langflow-ai langflow up to version 1.8.3 allows authenticated users to inject malicious scripts into chat messages via the edit-message component, which are then executed in the browsers of other users viewing the manipulated message. The vulnerability requires user interaction (recipient must view the crafted message) and authenticated access, limiting scope to users within a langflow instance, but publicly available exploit code exists and the vendor has not responded to early disclosure.
Technical ContextAI
The vulnerability exists in a React frontend component (edit-message.tsx) responsible for rendering and editing chat messages in langflow's UI. The underlying issue is improper input sanitization when processing user-controlled chat message content, violating CWE-79 (Improper Neutralization of Input During Web Page Generation). React components rendering user input without proper escaping or Content Security Policy enforcement allow injected HTML/JavaScript to execute in the context of other authenticated users' browsers. The affected product is langflow-ai langflow, an open-source flow-based language model orchestration platform, with versions up to 1.8.3 vulnerable. The attack vector is network-based exploitation of the frontend UI, requiring the attacker to already be authenticated to the langflow instance and manipulate a message they have permission to edit.
RemediationAI
Upgrade langflow to a patched version greater than 1.8.3 immediately; however, no vendor-released patch version has been confirmed in available data, and the vendor has not responded to disclosure. As an interim compensating control, implement network-level Content Security Policy (CSP) headers on the langflow instance to disable inline script execution and restrict script sources to trusted domains only - this will break XSS payload execution even if injected but may impact legitimate React functionality requiring evaluation. Additionally, restrict chat message editing capabilities to specific roles and audit message modifications for suspicious content. If multi-user collaboration is not required, disable message editing entirely or limit edit access to administrators only. Monitor for indicators of compromise: check for unusual JavaScript execution in browser console during chat use, review authentication logs for token theft or unauthorized access, and inspect local storage/cookies for exfiltration. Note that these controls do not eliminate the underlying vulnerability but reduce exploitability window until patched. Contact langflow-ai for patch availability or consider migrating to an alternative if the vendor continues non-response.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today