Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

langflow

43 known vulnerabilities (18 critical, 15 high, 10 medium), with the versions each affects and the releases that fix them.

Latest release
1.13.1 (Nov 4, 2026): no advisory affects it
Newest unaffected release
1.13.1 (Nov 4, 2026), the latest release
Advisories
43 · 18 critical, 15 high, 10 medium
Weekly downloads
8,271
Dependents
0
Releases
500+ since 0.0.87 (Jun 8, 2023)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 43 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 43

  • Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

    Affected: from 1.5.0, fixed in 1.10.3.

    Fixed in 1.10.3 (released Jul 23, 2026, 74 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

    Affected: from 1.6.8, fixed in 1.9.1.

    Fixed in 1.9.1 (released Apr 24, 2026, 164 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-105698Medium 5.4

    Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

    Affected: from 1.0.0, fixed in 1.10.1.

    Fixed in 1.10.1 (released Jun 23, 2026, 104 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-105697Critical 9.9

    Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

    Affected: from 1.1.2, fixed in 1.10.3.

    Fixed in 1.10.3 (released Jul 23, 2026, 74 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-51886Critical 9.8

    langflow-ai langflow v1.9.3 is affected by: Code Injection.

    Affected: from 1.7.2, fixed in 1.10.1.

    Fixed in 1.10.1 (released Jun 23, 2026, 100 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow is affected by weaknesses in secret handling and sensitive configuration access

    Affected: fixed in 1.10.1.

    Fixed in 1.10.1 (released Jun 23, 2026, 43 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-8505Critical 9.8

    Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

    Affected: from 1.7.0, fixed in 1.9.1.

    Fixed in 1.9.1 (released Apr 24, 2026, 84 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-7873Critical 9.9

    Code Injection Vulnerability in Code Validation Endpoint

    Affected: from 1.0.0, fixed in 1.10.1.rc0.

    Fixed in 1.10.1rc0 (released Jun 22, 2026, 8 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-48520Medium 6.1

    Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

    Affected: fixed in 1.10.0.

    Fixed in 1.10.0 (released Jun 9, 2026, 14 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 70 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-42867Medium 6.5

    Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 70 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-55255High 8.4 · KEV

    Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

    Affected: fixed in 1.9.1; fixed in 1.9.2.

    Fixed in 1.9.2 (released May 1, 2026, 53 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-55423Medium 6.1

    Langflow: Logout button does not clear session

    Affected: fixed in 1.7.0.

    Fixed in 1.7.0 (released Dec 18, 2025, 187 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow: Unauthenticated DoS through multipart form boundary file upload

    Affected: fixed in 1.0.19.

    Fixed in 1.0.19 (released Oct 10, 2024, 621 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-48519Critical 9.6

    Langflow: Unauthenticated RCE in Shareable Playgrounds

    Affected: fixed in 1.9.2.

    Fixed in 1.9.2 (released May 1, 2026, 53 days before disclosure).

    The latest release, 1.13.1, is not affected.

Show all 43 advisoriesShow fewer advisories
  • CVE-2026-55447Critical 9.6

    Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

    Affected: fixed in 1.9.2.

    Fixed in 1.9.2 (released May 1, 2026, 53 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-55450Critical 9.3

    Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

    Affected: fixed in 1.9.1.

    Fixed in 1.9.1 (released Apr 24, 2026, 60 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-10561Critical 10.0

    Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection

    Affected: fixed in 1.10.1.

    Fixed in 1.10.1 (released Jun 23, 2026, 1 day after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-42048Critical 9.6

    Langflow: Path Traversal in Langflow Knowledge Bases API

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 28 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-7700Medium 5.3

    langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection

    Affected: from 1.3.0, fixed in 1.10.3.

    Fixed in 1.10.3 (released Jul 23, 2026, 81 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-6599Medium 5.3

    langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection

    Affected: through 1.8.3.

    Fixed in 1.8.4 (released Apr 1, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-6598Medium 5.3

    langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file

    Affected: fixed in 1.9.1.

    Fixed in 1.9.1 (released Apr 24, 2026, 4 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-6597Medium 5.1

    langflow-ai langflow Flow Using API core.py has_api_terms credentials storage

    Affected: through 1.8.3.

    Fixed in 1.8.4 (released Apr 1, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

    Affected: fixed in 1.5.1.

    Fixed in 1.5.1 (released Aug 28, 2025, 211 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-33873Critical 9.3

    Langflow has Authenticated Code Execution in Agentic Assistant Validation

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 18 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

    Affected: fixed in 1.7.1.

    Fixed in 1.7.1 (released Dec 19, 2025, 95 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow has Unauthenticated IDOR on Image Downloads

    Affected: from 1.0.0, fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 21 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-33309Critical 10.0

    Langflow has an Arbitrary File Write (RCE) via v2 API

    Affected: from 1.2.0, fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 21 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-33053Medium 6.1

    Langflow has Missing Ownership Verification in API Key Deletion (IDOR)

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 25 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-33017Critical 9.3 · KEV

    Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

    Affected: fixed in 1.9.0.

    Fixed in 1.9.0 (released Apr 14, 2026, 25 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-27966Critical 9.8

    Langflow has Remote Code Execution in CSV Agent

    Affected: through 1.8.0rc2.

    Fixed in 1.8.0 (released Mar 5, 2026, 7 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • CVE-2026-0770Critical 9.8 · KEV

    Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

    Affected: through 1.7.3.

    Fixed in 1.8.0 (released Mar 5, 2026, 41 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • Langflow Missing Authentication on Critical API Endpoints

    Affected: fixed in 1.7.1.

    Fixed in 1.7.1 (released Dec 19, 2025, 14 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow Vulnerable to External Control of File Name or Path

    Affected: fixed in 1.7.1; fixed in 1.7.0.

    Fixed in 1.7.1 (released Dec 19, 2025, the day of disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow vulnerable to Server-Side Request Forgery

    Affected: fixed in 1.7.1.

    Fixed in 1.7.1 (released Dec 19, 2025, the day of disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2025-34291Critical 9.4 · KEV

    Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

    Affected: fixed in 1.7.0.

    Fixed in 1.7.0 (released Dec 18, 2025, 13 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation

    Affected: fixed in 1.5.0; fixed in 1.5.1.

    Fixed in 1.5.1 (released Aug 28, 2025, 3 days after disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2025-3248Critical 9.8 · KEV

    Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

    Affected: fixed in 1.3.0.

    Fixed in 1.3.0 (released Mar 31, 2025, 7 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • CVE-2024-48061Critical 9.8

    langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on…

    Affected: through 1.0.18.

    Fixed in 1.0.19 (released Oct 10, 2024, 25 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • CVE-2024-42835Critical 9.8

    langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

    Affected: through 1.0.12.

    Fixed in 1.0.13 (released Jul 26, 2024, 97 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • CVE-2024-9277Medium 5.1

    Langflow HTTP POST Request utils.py redos

    Affected: through 1.0.18.

    Fixed in 1.0.19 (released Oct 10, 2024, 13 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.13.1, is not affected.

  • Langflow Privilege Escalation

    Affected: fixed in 1.0.13.

    Fixed in 1.0.13 (released Jul 26, 2024, 4 days before disclosure).

    The latest release, 1.13.1, is not affected.

  • Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and…

    Affected: fixed in 1.0.15; fixed in 1.0.0a3.

    Fixed in 1.0.15 (released Aug 12, 2024, 63 days after disclosure).

    The latest release, 1.13.1, is not affected.