Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Langflow is affected by security vulnerabilities in Model Context Protocol features

Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files

SSRF Protection Configuration Vulnerability

DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Langflow - Application Logs Exposed to All Authenticated Users

Langflow is a tool for building and deploying AI-powered agents and workflows

A vulnerability classified as problematic was found in Langflow up to 1.0.18

langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection

langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

langflow-ai langflow Model Context Protocol Configuration API mcp_projects.py install_mcp_config injection

Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

Langflow: Logout button does not clear session

Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Langflow - Stored XSS via Malicious SVG Upload

Langflow - Missing Authorization on download_image Endpoint

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Langflow OSS is affected by multiple vulnerabilities

Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file

langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting

langflow-ai langflow Flow Using API core.py has_api_terms credentials storage