IBM Langflow OSS CVE-2026-8447

The attacker requires network access to the Langflow OSS Playground chat interface; per PR:N in the CVSS vector, no authentication credentials are needed to submit the malicious payload. Exploitation of the stored payload additionally requires that a victim user (UI:R) loads the affected chat view after injection - automated mass exploitation is not feasible without social engineering or waiting for organic victim activity. The application must be running an affected version (1.0.0-1.11.2). Higher-impact outcomes (e.g., full session takeover, admin-level actions) depend on the victim being an authenticated user with elevated privileges within the application.

The CVSS 6.1 Medium score reflects real but bounded impact: confidentiality and integrity are both rated Low, availability is unaffected. PR:N in the provided vector indicates the payload injection phase requires no authentication, making any internet-reachable Langflow OSS Playground instance a viable injection target. However, exploitation of the stored payload is gated on UI:R - a victim user must actively load the chat view after injection. If that victim is an administrator, the effective impact could exceed the base CVSS score due to elevated session privileges. No EPSS data was provided, no public exploit code has been identified, and the vulnerability is not in CISA KEV. Real-world risk is moderate: the injection surface is straightforward and unauthenticated, but weaponization depends on a privileged user visiting the affected view, limiting automated or mass exploitation.

An unauthenticated attacker submits a crafted message containing a malicious JavaScript payload to the publicly accessible Langflow OSS Playground chat interface, where it is stored without sanitization. When an administrator or authenticated user later opens the chat view, their browser renders and executes the payload in the application's origin context. No public exploit code has been identified, but the attack requires no special tooling beyond a standard HTTP request to the chat endpoint.