Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

Remote Code Execution in CUGA Component CodeAgent

Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Disk Cache Deserialization Remote Code Execution Vulnerability

Remote Code Execution via Code Validation Endpoint

Arbitrary Code Execution in Python Interpreter Component

Path Traversal in APIRequest Component via Content-Disposition Header

Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation

Code Injection Vulnerability in Code Validation Endpoint

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

Unauthenticated User Registration Could Lead to Remote Code Execution

Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass

Flow Validation Bypass via Empty Component Type Field

Insecure Deserialization in Redis Cache Backend

Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

Incomplete Security Scanner Blocklist Enables Network-Based Code Execution

Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem

Insufficient Authentication Brute Force Protection on Login Endpoint

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS

Weak Cryptographic Key Derivation Exposed All Stored Credentials