Langflow

OS command injection in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets an authenticated user run arbitrary system commands with elevated privileges by abusing improper input validation in the Python Interpreter component. Because the flaw sits in a feature that already executes user-supplied Python, any logged-in user can escalate to full host command execution (CVSS 8.8, CWE-78). No public exploit identified at time of analysis, though the low attack complexity and network vector make it high-priority for any exposed Langflow deployment.

Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets anonymous attackers run arbitrary code by abusing the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The CVSS 3.1 base score is 9.8 (network, low complexity, no privileges or user interaction). No public exploit is identified at time of analysis, and the EPSS probability is modest at 0.44% (36th percentile), indicating exploitation is technically trivial but not yet observed at scale.

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.6 lets an attacker coerce the application into making arbitrary HTTP requests via the legacy RSSReaderComponent (rss.py) and the SearXNG component (searxng.py), which fetch user-controlled URLs without validation. These two components bypass the SSRF protections that were added in version 1.9.3, allowing reach into internal resources such as AWS/Azure/GCP instance metadata (IMDS) to steal IAM credentials and enumerate internal networks. The flaw is reachable directly by an authenticated user and indirectly through prompt injection in agentic workflows because the components are exposed with tool_mode=True; no public exploit identified at time of analysis.

Information disclosure and denial of service in IBM Langflow OSS 1.0.0 through 1.9.6 stem from missing authentication on the /api/v1/build_public_tmp/ endpoints, letting an unauthenticated attacker who supplies a valid job identifier read build event data or cancel running jobs. The flaw carries a CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and CWE-287 classification; there is no public exploit identified at time of analysis, and EPSS is low at 0.25% (17th percentile) with CISA SSVC recording no observed exploitation but flagging it as automatable.

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 allows a low-privileged authenticated user to coerce the server into making attacker-controlled internal requests by abusing the URL data-source component, where a Time-of-Check/Time-of-Use race condition lets a hostname resolve to a safe address during validation and a private/internal address at fetch time (classic DNS rebinding). Exploitation is rated CVSS 7.1 with a scope change, reflecting that the server can be made to reach internal services beyond its own trust boundary; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Cross-tenant credential confusion in IBM Langflow OSS 1.0.0 through 1.10.0 lets an authenticated user manipulate the voice-mode shared cache so that other tenants' requests are processed with the wrong upstream API credentials, causing billing and accountability to be misattributed across tenant boundaries. The flaw (CWE-639) requires only low-privilege authentication and is rated critical (CVSS 9.6) because a scope change extends the impact to other users and upstream services. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary Python via the flow `tool_code` mechanism, gaining full control of the Langflow process. Because the scope changes (S:C), the attacker can read every process secret, read and tamper with all flows, conversations, messages, uploads and saved components in the database, reach internal services and cloud metadata endpoints, and pivot across tenants on the same instance. This is a maximum-severity (CVSS 10.0) flaw, though no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 lets an authenticated flow-author bypass the API Request component's SSRF protections by toggling the follow_redirects parameter and pointing it at a benign public URL that redirects to internal or localhost targets. Because only the initial URL is validated and redirect destinations are not re-checked, attackers can pivot to cloud metadata services, localhost endpoints, and private-network HTTP services to exfiltrate credentials, tokens, and admin-panel data. No public exploit identified at time of analysis; risk is driven by the CVSS 8.5 rating and the high value of cloud-metadata SSRF targets rather than confirmed in-the-wild use.

Code injection in langflow's Bundle URL Loader component allows local attackers with low privileges to inject and execute arbitrary code within the langflow process across versions 1.9.0 through 1.9.3. A publicly available proof-of-concept demonstrating startup-time RCE via maliciously crafted bundle URLs has been published by the researcher, though the CVSS 4.0 vector (VC:L/VI:L/VA:L) rates impact as low - a discrepancy with the RCE claim in the PoC that warrants independent verification. No vendor-released patch is available; the vendor did not respond to the researcher's disclosure.

Code injection via the eval function in Langflow's LambdaFilterComponent allows remote authenticated attackers to execute arbitrary code with low-to-medium integrity and confidentiality impact. The vulnerability affects Langflow up to version 1.8.4, requires user login (PR:L), and has publicly available exploit code. The vendor did not respond to early disclosure notification.

Stored cross-site scripting (XSS) in langflow-ai langflow up to version 1.8.3 allows authenticated users to inject malicious scripts into chat messages via the edit-message component, which are then executed in the browsers of other users viewing the manipulated message. The vulnerability requires user interaction (recipient must view the crafted message) and authenticated access, limiting scope to users within a langflow instance, but publicly available exploit code exists and the vendor has not responded to early disclosure.

Code injection in langflow-ai langflow up to version 1.8.3 allows authenticated remote attackers to execute arbitrary code via manipulation of the X-Forwarded-For HTTP header in the Model Context Protocol Configuration API endpoint. The vulnerability affects the get_client_ip function in src/backend/base/langflow/api/v1/mcp_projects.py and has publicly available exploit code; the vendor did not respond to early disclosure notification.

Langflow up to version 1.8.3 stores authentication settings in cleartext on disk when processing project creation requests, allowing authenticated remote attackers to read sensitive credentials. The vulnerability exists in the create_project/encrypt_auth_settings function within the Project Creation Endpoint, where the auth_settings parameter bypasses encryption despite the function's intent. Publicly available exploit code exists, and the vendor has not released a patch or responded to disclosure notices.

Langflow up to version 1.8.3 stores API credentials without encryption in the remove_api_keys and has_api_terms functions, allowing remote attackers with high privileges to disclose sensitive credentials through the Flow Using API component. The vulnerability has publicly available exploit code, though real-world exploitation likelihood is constrained by the requirement for high-privilege access; vendor has not responded to disclosure.

Unrestricted file upload in Langflow (langflow-ai) versions up to 1.1.0 allows remote unauthenticated attackers to upload arbitrary files via the create_upload_file API endpoint, potentially leading to remote code execution, data manipulation, and service disruption. Publicly available exploit code exists (CVSS:3.1 E:P) with GIST-hosted POC, elevating immediate risk. Vendor unresponsive to disclosure at time of publication.

Stored XSS in Langflow's image serving endpoint allows authenticated attackers to steal session tokens via malicious SVG uploads. The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves user-uploaded SVG files with 'image/svg+xml' content type without sanitization, enabling embedded JavaScript execution in victim browsers. Authenticated attackers with low privileges can upload crafted SVGs that execute in other users' contexts, exfiltrating JWT access and refresh tokens from cookies. EPSS probability is low (0.07%, 22nd percentile) with no active exploitation confirmed (SSVC: none), but the attack is straightforward for authenticated users with file upload permissions.

Log router endpoints in an authenticated application expose full application log buffers to any authenticated user without privilege-level authorization checks, allowing credential harvesting, sensitive data exfiltration, and reconnaissance. The vulnerability affects the '/logs' and '/logs-stream' endpoints which enforce only basic authentication ('get_current_active_user') rather than administrative privilege requirements, enabling authenticated attackers with low privileges to read complete application logs containing sensitive information. No public exploit code or active exploitation has been identified at the time of analysis, though the relatively low attack complexity (AC:L) and straightforward authentication bypass mechanism present moderate real-world risk.

Langflow's '/api/v1/files/images/{flow_id}/{file_name}' endpoint lacks authentication and authorization enforcement, permitting unauthenticated users to download arbitrary images associated with any flow by supplying or enumerating flow IDs and file names. This authentication bypass affects all versions of Langflow AI's langflow product and enables unauthorized disclosure of potentially sensitive image assets. No public exploit code or active exploitation has been confirmed at the time of analysis.

Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary code execution through crafted CSV files. EPSS 0.41% with PoC and patch available.

Remote code execution in Langflow's disk cache service allows authenticated attackers to execute arbitrary code by exploiting improper deserialization of untrusted data. The vulnerability affects Langflow installations and requires valid authentication credentials to exploit, enabling attackers to gain code execution within the service account context. No patch is currently available.

Langflow's PythonFunction component allows authenticated attackers with user interaction to inject and execute arbitrary Python code within application workflows, achieving remote code execution. The vulnerability affects Langflow deployments using Python-based AI/ML components, with exploitation feasibility depending on specific product configurations. No patch is currently available.

Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes in the application's global scope.

Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted custom component definitions.

Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the visual AI workflow builder.

Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to user conversations, transaction data, and message deletion. Critical for AI workflow platforms that handle sensitive prompt data.

Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfiguration (allow_origins='*' with credentials) and a SameSite=None refresh token cookie. An attacker controlling a malicious webpage can steal authentication tokens and gain full access, including built-in code execution, leading to complete system compromise. This vulnerability is confirmed actively exploited (CISA KEV), with publicly available exploit code and a high EPSS score (17.62%), indicating widespread attack likelihood.

Langflow is a tool for building and deploying AI-powered agents and workflows. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling attackers to execute arbitrary Python code on the server without authentication.

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability classified as problematic was found in Langflow up to 1.0.18. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged attacker to gain super admin privileges by performing a mass assignment. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.