# langflow (PyPI) vulnerabilities 43 known vulnerabilities (18 critical, 15 high, 10 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.13.1 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 1.13.1 (Nov 4, 2026), the latest release - Weekly downloads: 8,271 - Dependents: 0 - Releases: 500+ since 0.0.87 (Jun 8, 2023) - Registry: https://pypi.org/project/langflow/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-105741: 1.5.0 to 1.10.3rc0 (1.10.3 is outside it) - CVE-2026-105699: 1.6.8 to 1.9.0 (1.9.1 is outside it) - CVE-2026-105698: 1.0.0 to 1.10.1rc3 (1.10.1 is outside it) - CVE-2026-105697: 1.1.2 to 1.10.3rc0 (1.10.3 is outside it) - CVE-2026-51886: 1.7.2 to 1.10.1rc3 (1.10.1 is outside it) - CVE-2026-9205: 0.0.87 to 1.10.1rc3 (1.10.1 is outside it) - CVE-2026-8505: 1.7.0 to 1.9.0 (1.9.1 is outside it) - CVE-2026-7873: 1.0.0 to 1.10.0 (1.10.1rc0 is outside it) - CVE-2026-48520: 0.0.87 to 1.10.0rc0 (1.10.0 is outside it) - CVE-2026-33760: 0.0.87 to 1.8.4 (1.9.0 is outside it) - CVE-2026-42867: 0.0.87 to 1.8.4 (1.9.0 is outside it) - CVE-2026-55255: 0.0.87 to 1.9.1 (1.9.2 is outside it) - CVE-2026-55423: 0.0.87 to 1.6.9 (1.7.0 is outside it) - CVE-2026-55446: 0.0.87 to 1.0.18 (1.0.19 is outside it) - CVE-2026-48519: 0.0.87 to 1.9.1 (1.9.2 is outside it) - CVE-2026-55447: 0.0.87 to 1.9.1 (1.9.2 is outside it) - CVE-2026-55450: 0.0.87 to 1.9.0 (1.9.1 is outside it) - CVE-2026-10561: 0.0.87 to 1.10.1rc3 (1.10.1 is outside it) - CVE-2026-42048: 0.0.87 to 1.8.4 (1.9.0 is outside it) - CVE-2026-7700: 1.3.0 to 1.10.3rc0 (1.10.3 is outside it) - CVE-2026-6599: 0.0.87 to 1.8.3 (1.8.4 is outside it) - CVE-2026-6598: 0.0.87 to 1.9.0 (1.9.1 is outside it) - CVE-2026-6597: 0.0.87 to 1.8.3 (1.8.4 is outside it) - CVE-2026-34046: 0.0.87 to 1.5.0.post2 (1.5.1 is outside it) - CVE-2026-33873: 0.0.87 to 1.8.4 (1.9.0 is outside it) - CVE-2026-33497: 0.0.87 to 1.7.0 (1.7.1 is outside it) - CVE-2026-33484: 1.0.0 to 1.8.4 (1.9.0 is outside it) - CVE-2026-33309: 1.2.0 to 1.8.4 (1.9.0 is outside it) - CVE-2026-33053: 0.0.87 to 1.8.4 (1.9.0 is outside it) - CVE-2026-33017: 0.0.87 to 1.8.4 (1.9.0 is outside it) - CVE-2026-27966: 0.0.87 to 1.8.0rc2 (1.8.0rc3 is outside it) - CVE-2026-0770: 0.0.87 to 1.7.3 (1.8.0rc0 is outside it) - CVE-2026-21445: 0.0.87 to 1.7.0 (1.7.1 is outside it) - CVE-2025-68478: 0.0.87 to 1.7.0 (1.7.1 is outside it) - CVE-2025-68477: 0.0.87 to 1.7.0 (1.7.1 is outside it) - CVE-2025-34291: 0.0.87 to 1.6.9 (1.7.0 is outside it) - CVE-2025-57760: 0.0.87 to 1.5.0.post2 (1.5.1 is outside it) - CVE-2025-3248: 0.0.87 to 1.2.0 (1.3.0 is outside it) - CVE-2024-48061: 0.0.87 to 1.0.18 (1.0.19 is outside it) - CVE-2024-42835: 0.0.87 to 1.0.12 (1.0.13 is outside it) - CVE-2024-9277: 0.0.87 to 1.0.18 (1.0.19 is outside it) - CVE-2024-7297: 0.0.87 to 1.0.12 (1.0.13 is outside it) - CVE-2024-37014: 0.0.87 to 1.0.14 (1.0.15 is outside it) Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (43) ### [CVE-2026-105741](https://cve.now/CVE-2026-105741): Langflow: IP Spoofing Bypass via \`X-Forwarded-For\` Allowing Remote Configuration Write - Severity: High 7.1 - Published: Oct 5, 2026 - Affected: from 1.5.0, fixed in 1.10.3. - Fixed in 1.10.3 (released Jul 23, 2026, 74 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-105699](https://cve.now/CVE-2026-105699): Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers - Severity: High 7.1 - Published: Oct 5, 2026 - Affected: from 1.6.8, fixed in 1.9.1. - Fixed in 1.9.1 (released Apr 24, 2026, 164 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-105698](https://cve.now/CVE-2026-105698): Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow\_id}/vertices endpoints - Severity: Medium 5.4 - Published: Oct 5, 2026 - Affected: from 1.0.0, fixed in 1.10.1. - Fixed in 1.10.1 (released Jun 23, 2026, 104 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-105697](https://cve.now/CVE-2026-105697): Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration - Severity: Critical 9.9 - Published: Oct 5, 2026 - Affected: from 1.1.2, fixed in 1.10.3. - Fixed in 1.10.3 (released Jul 23, 2026, 74 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-51886](https://cve.now/CVE-2026-51886): langflow-ai langflow v1.9.3 is affected by: Code Injection. - Severity: Critical 9.8 - Published: Oct 1, 2026 - Affected: from 1.7.2, fixed in 1.10.1. - Fixed in 1.10.1 (released Jun 23, 2026, 100 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-9205](https://cve.now/CVE-2026-9205): Langflow is affected by weaknesses in secret handling and sensitive configuration access - Severity: High 7.4 - Published: Aug 5, 2026 - Affected: fixed in 1.10.1. - Fixed in 1.10.1 (released Jun 23, 2026, 43 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-8505](https://cve.now/CVE-2026-8505): Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution - Severity: Critical 9.8 - Published: Jul 17, 2026 - Affected: from 1.7.0, fixed in 1.9.1. - Fixed in 1.9.1 (released Apr 24, 2026, 84 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-7873](https://cve.now/CVE-2026-7873): Code Injection Vulnerability in Code Validation Endpoint - Severity: Critical 9.9 - Published: Jun 30, 2026 - Affected: from 1.0.0, fixed in 1.10.1.rc0. - Fixed in 1.10.1rc0 (released Jun 22, 2026, 8 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-48520](https://cve.now/CVE-2026-48520): Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read - Severity: Medium 6.1 - Published: Jun 23, 2026 - Affected: fixed in 1.10.0. - Fixed in 1.10.0 (released Jun 9, 2026, 14 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33760](https://cve.now/CVE-2026-33760): Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints - Severity: High 8.8 - Published: Jun 23, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 70 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-42867](https://cve.now/CVE-2026-42867): Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint - Severity: Medium 6.5 - Published: Jun 23, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 70 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-55255](https://cve.now/CVE-2026-55255): Langflow: IDOR Vulnerability in \`/api/v1/responses\` Endpoint Allows Authenticated Attackers to Access Another User's Flow - Severity: High 8.4 · KEV - Published: Jun 23, 2026 - Affected: fixed in 1.9.1; fixed in 1.9.2. - Fixed in 1.9.2 (released May 1, 2026, 53 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-55423](https://cve.now/CVE-2026-55423): Langflow: Logout button does not clear session - Severity: Medium 6.1 - Published: Jun 23, 2026 - Affected: fixed in 1.7.0. - Fixed in 1.7.0 (released Dec 18, 2025, 187 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-55446](https://cve.now/CVE-2026-55446): Langflow: Unauthenticated DoS through multipart form boundary file upload - Severity: High 7.5 - Published: Jun 23, 2026 - Affected: fixed in 1.0.19. - Fixed in 1.0.19 (released Oct 10, 2024, 621 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-48519](https://cve.now/CVE-2026-48519): Langflow: Unauthenticated RCE in Shareable Playgrounds - Severity: Critical 9.6 - Published: Jun 23, 2026 - Affected: fixed in 1.9.2. - Fixed in 1.9.2 (released May 1, 2026, 53 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-55447](https://cve.now/CVE-2026-55447): Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit - Severity: Critical 9.6 - Published: Jun 23, 2026 - Affected: fixed in 1.9.2. - Fixed in 1.9.2 (released May 1, 2026, 53 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-55450](https://cve.now/CVE-2026-55450): Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak - Severity: Critical 9.3 - Published: Jun 23, 2026 - Affected: fixed in 1.9.1. - Fixed in 1.9.1 (released Apr 24, 2026, 60 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-10561](https://cve.now/CVE-2026-10561): Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection - Severity: Critical 10.0 - Published: Jun 22, 2026 - Affected: fixed in 1.10.1. - Fixed in 1.10.1 (released Jun 23, 2026, 1 day after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-42048](https://cve.now/CVE-2026-42048): Langflow: Path Traversal in Langflow Knowledge Bases API - Severity: Critical 9.6 - Published: May 12, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 28 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-7700](https://cve.now/CVE-2026-7700): langflow-ai langflow LambdaFilterComponent lambda\_filter.py eval code injection - Severity: Medium 5.3 - Published: May 3, 2026 - Affected: from 1.3.0, fixed in 1.10.3. - Fixed in 1.10.3 (released Jul 23, 2026, 81 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-6599](https://cve.now/CVE-2026-6599): langflow-ai langflow Model Context Protocol Configuration API mcp\_projects.py install\_mcp\_config injection - Severity: Medium 5.3 - Published: Apr 20, 2026 - Affected: through 1.8.3. - Fixed in 1.8.4 (released Apr 1, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2026-6598](https://cve.now/CVE-2026-6598): langflow-ai langflow Project Creation Endpoint projects.py encrypt\_auth\_settings cleartext storage in file - Severity: Medium 5.3 - Published: Apr 20, 2026 - Affected: fixed in 1.9.1. - Fixed in 1.9.1 (released Apr 24, 2026, 4 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-6597](https://cve.now/CVE-2026-6597): langflow-ai langflow Flow Using API core.py has\_api\_terms credentials storage - Severity: Medium 5.1 - Published: Apr 20, 2026 - Affected: through 1.8.3. - Fixed in 1.8.4 (released Apr 1, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2026-34046](https://cve.now/CVE-2026-34046): Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check - Severity: High 8.7 - Published: Mar 27, 2026 - Affected: fixed in 1.5.1. - Fixed in 1.5.1 (released Aug 28, 2025, 211 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33873](https://cve.now/CVE-2026-33873): Langflow has Authenticated Code Execution in Agentic Assistant Validation - Severity: Critical 9.3 - Published: Mar 27, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 18 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33497](https://cve.now/CVE-2026-33497): Langflow: /profile\_pictures/{folder\_name}/{file\_name} endpoint file reading - Severity: High 8.7 - Published: Mar 24, 2026 - Affected: fixed in 1.7.1. - Fixed in 1.7.1 (released Dec 19, 2025, 95 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33484](https://cve.now/CVE-2026-33484): Langflow has Unauthenticated IDOR on Image Downloads - Severity: High 7.5 - Published: Mar 24, 2026 - Affected: from 1.0.0, fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 21 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33309](https://cve.now/CVE-2026-33309): Langflow has an Arbitrary File Write (RCE) via v2 API - Severity: Critical 10.0 - Published: Mar 24, 2026 - Affected: from 1.2.0, fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 21 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33053](https://cve.now/CVE-2026-33053): Langflow has Missing Ownership Verification in API Key Deletion (IDOR) - Severity: Medium 6.1 - Published: Mar 20, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 25 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-33017](https://cve.now/CVE-2026-33017): Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint - Severity: Critical 9.3 · KEV - Published: Mar 20, 2026 - Affected: fixed in 1.9.0. - Fixed in 1.9.0 (released Apr 14, 2026, 25 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2026-27966](https://cve.now/CVE-2026-27966): Langflow has Remote Code Execution in CSV Agent - Severity: Critical 9.8 - Published: Feb 26, 2026 - Affected: through 1.8.0rc2. - Fixed in 1.8.0 (released Mar 5, 2026, 7 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2026-0770](https://cve.now/CVE-2026-0770): Langflow exec\_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability - Severity: Critical 9.8 · KEV - Published: Jan 23, 2026 - Affected: through 1.7.3. - Fixed in 1.8.0 (released Mar 5, 2026, 41 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2026-21445](https://cve.now/CVE-2026-21445): Langflow Missing Authentication on Critical API Endpoints - Severity: High 8.8 - Published: Jan 2, 2026 - Affected: fixed in 1.7.1. - Fixed in 1.7.1 (released Dec 19, 2025, 14 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2025-68478](https://cve.now/CVE-2025-68478): Langflow Vulnerable to External Control of File Name or Path - Severity: High 7.1 - Published: Dec 19, 2025 - Affected: fixed in 1.7.1; fixed in 1.7.0. - Fixed in 1.7.1 (released Dec 19, 2025, the day of disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2025-68477](https://cve.now/CVE-2025-68477): Langflow vulnerable to Server-Side Request Forgery - Severity: High 7.7 - Published: Dec 19, 2025 - Affected: fixed in 1.7.1. - Fixed in 1.7.1 (released Dec 19, 2025, the day of disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2025-34291](https://cve.now/CVE-2025-34291): Langflow \<= 1.6.9 CORS Misconfiguration to Token Hijack & RCE - Severity: Critical 9.4 · KEV - Published: Dec 5, 2025 - Affected: fixed in 1.7.0. - Fixed in 1.7.0 (released Dec 18, 2025, 13 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2025-57760](https://cve.now/CVE-2025-57760): Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation - Severity: High 8.8 - Published: Aug 25, 2025 - Affected: fixed in 1.5.0; fixed in 1.5.1. - Fixed in 1.5.1 (released Aug 28, 2025, 3 days after disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2025-3248](https://cve.now/CVE-2025-3248): Langflow \< 1.3.0 Unauthenticated RCE via /api/v1/validate/code - Severity: Critical 9.8 · KEV - Published: Apr 7, 2025 - Affected: fixed in 1.3.0. - Fixed in 1.3.0 (released Mar 31, 2025, 7 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2024-48061](https://cve.now/CVE-2024-48061): langflow \<=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on… - Severity: Critical 9.8 - Published: Nov 4, 2024 - Affected: through 1.0.18. - Fixed in 1.0.19 (released Oct 10, 2024, 25 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2024-42835](https://cve.now/CVE-2024-42835): langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component. - Severity: Critical 9.8 - Published: Oct 31, 2024 - Affected: through 1.0.12. - Fixed in 1.0.13 (released Jul 26, 2024, 97 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2024-9277](https://cve.now/CVE-2024-9277): Langflow HTTP POST Request utils.py redos - Severity: Medium 5.1 - Published: Sep 27, 2024 - Affected: through 1.0.18. - Fixed in 1.0.19 (released Oct 10, 2024, 13 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 1.13.1, is not affected. ### [CVE-2024-7297](https://cve.now/CVE-2024-7297): Langflow Privilege Escalation - Severity: High 8.8 - Published: Jul 30, 2024 - Affected: fixed in 1.0.13. - Fixed in 1.0.13 (released Jul 26, 2024, 4 days before disclosure). - The latest release, 1.13.1, is not affected. ### [CVE-2024-37014](https://cve.now/CVE-2024-37014): Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom\_component" endpoint and… - Severity: High 8.8 - Published: Jun 10, 2024 - Affected: fixed in 1.0.15; fixed in 1.0.0a3. - Fixed in 1.0.15 (released Aug 12, 2024, 63 days after disclosure). - The latest release, 1.13.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/langflow Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.