Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability

Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

Remote Code Execution in CUGA Component CodeAgent

Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure

Disk Cache Deserialization Remote Code Execution Vulnerability

Remote Code Execution via Code Validation Endpoint

Arbitrary Code Execution in Python Interpreter Component

Path Traversal in APIRequest Component via Content-Disposition Header

Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation

Code Injection Vulnerability in Code Validation Endpoint

Langflow has Authenticated Code Execution in Agentic Assistant Validation

Langflow has an Arbitrary File Write (RCE) via v2 API

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow OSS is affected by multiple vulnerabilities

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

Unauthenticated User Registration Could Lead to Remote Code Execution

Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass

Flow Validation Bypass via Empty Component Type Field

Insecure Deserialization in Redis Cache Backend

Unauthenticated Flow Execution via Webhook Endpoint in Langflow OSS

Path Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code Execution

Langflow has Remote Code Execution in CSV Agent

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

Langflow code Code Injection Remote Code Execution Vulnerability

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a…

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script

Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem

Langflow: Unauthenticated RCE in Shareable Playgrounds

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Langflow: Path Traversal in Langflow Knowledge Bases API

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Insufficient Authentication Brute Force Protection on Login Endpoint

Langflow is affected by weaknesses in secret handling and sensitive configuration access

Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS