What is the CVSS score of EUVD-2026-26425?

EUVD-2026-26425 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-26425?

Yes, a patch is available for EUVD-2026-26425. Update the affected software to the latest version immediately.

IBM Langflow Desktop EUVD-2026-26425

| CVE-2026-3346 MEDIUM

SQL Injection (CWE-89)

2026-04-30 ibm

XSS IBM SQLi

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 21:46 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 21:15 euvd

EUVD-2026-26425

Analysis Generated

Apr 30, 2026 - 21:15 vuln.today

Patch released

Apr 30, 2026 - 21:15 nvd

Patch available

CVE Published

Apr 30, 2026 - 21:06 nvd

MEDIUM 6.4

DescriptionCVE.org

IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

AnalysisAI

Stored cross-site scripting in IBM Langflow Desktop 1.6.0 through 1.8.4 allows authenticated users to inject arbitrary JavaScript code into the Web UI, potentially altering application functionality and disclosing session credentials to other users of the same instance. The vulnerability requires valid authentication but no user interaction from the target, affecting confidentiality and integrity of the application.

Technical ContextAI

IBM Langflow Desktop is a low-code/no-code platform for building data pipelines and AI workflows. The vulnerability is a stored XSS flaw (CWE-89 maps to improper input validation in stored data contexts) where user-supplied input is not properly sanitized or encoded before being rendered in the Web UI. This allows malicious JavaScript to persist in the application's data store and execute in the browsers of other authenticated users viewing the same workflow or component, enabling session hijacking, credential theft, or malicious UI manipulation within the trusted application context.

RemediationAI

Upgrade to the patched version released by IBM. Consult the IBM support advisory at https://www.ibm.com/support/pages/node/7271095 for the specific fixed version number and download link. As a temporary compensating control, restrict Web UI access to Langflow Desktop instances to trusted IP ranges or VPN networks only, reducing the attack surface to authenticated users on controlled networks. Additionally, implement input validation and output encoding for all user-supplied content displayed in the Web UI; if possible, disable user-contributed content rendering or enable strict Content Security Policy (CSP) headers to block inline script execution. Note that network restriction does not eliminate the risk from malicious authenticated insiders and requires maintenance overhead. Patching is the recommended primary remediation.