Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

Langflow is affected by OS Command Injection in Model Context Protocol features

Langflow is affected OS Command Injection in Model Context Protocol features

Langflow is affected by security vulnerabilities in Model Context Protocol features

Langflow is affected by security vulnerabilities in Model Context Protocol features

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing

MCP Server Configuration Validator Bypass via File Upload API

Parameter Injection Vulnerability in API Graph Execution Engine

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features

SSRF via HTTP Redirect Following in Langflow API Request Component

Langflow OSS Authorization Bypass Through User-Controlled Key

Langflow OSS is affected by multiple vulnerabilities

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection

Langflow OSS is affected by multiple vulnerabilities

Langflow is vulnerable to authentication bypass and insufficient session expiration

Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

Unauthenticated Session History Access via Public Flow Execution

Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

Langflow is affected by security vulnerabilities in Model Context Protocol features