Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Langflow — Vulnerabilities & Security Advisories 49

All 49 CVE vulnerabilities found in Langflow, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability records associated with the open-source product Langflow, developed by DataStax. The collection primarily documents security flaws reported against the Langflow platform, covering its recent release history. Users can track the vendor’s advisory history, analyze recurring weakness classes such as injection and access control issues, and review the chronological development of vulnerabilities disclosed for this specific product.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-33497 Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading CWE-22 6.5 - 2026-03-24
CVE-2026-33484 Langflow has Unauthenticated IDOR on Image Downloads CWE-284 7.5 High 2026-03-24
CVE-2026-33475 Langflow GitHub Actions Shell Injection CWE-74 9.1 Critical 2026-03-24
CVE-2026-33309 Langflow has an Arbitrary File Write (RCE) via v2 API CWE-22 10.0 Critical 2026-03-24
CVE-2026-33053 Langflow has Missing Ownership Verification in API Key Deletion (IDOR) CWE-639 8.2 - 2026-03-20
CVE-2026-33017 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint CWE-94 9.8 - 2026-03-20
CVE-2026-27966 Langflow has Remote Code Execution in CSV Agent CWE-94 9.8 Critical 2026-02-26
CVE-2026-0772 Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability CWE-502 8.8 - 2026-01-23
CVE-2026-0771 Langflow PythonFunction Code Injection Remote Code Execution Vulnerability CWE-94 9.8 - 2026-01-23
CVE-2026-0770 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability CWE-829 9.8 - 2026-01-23
CVE-2026-0769 Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability CWE-95 9.8 - 2026-01-23
CVE-2026-0768 Langflow code Code Injection Remote Code Execution Vulnerability CWE-94 9.8 - 2026-01-23
CVE-2026-21445 Langflow Missing Authentication on Critical API Endpoints CWE-306 9.4 - 2026-01-02
CVE-2025-68478 Langflow Vulnerable to External Control of File Name or Path CWE-73 7.1 High 2025-12-19
CVE-2025-68477 Langflow vulnerable to Server-Side Request Forgery CWE-918 7.7 High 2025-12-19
CVE-2025-34291 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE CWE-346 9.4 Critical 2025-12-05
CVE-2025-57760 Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation CWE-269 8.8 High 2025-08-25
CVE-2025-3248 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code CWE-306 9.8 Critical 2025-04-07
CVE-2024-9277 Langflow HTTP POST Request utils.py redos CWE-1333 3.5 Low 2024-09-27

All 49 known CVE vulnerabilities affecting Langflow with full Chinese analysis, references, and POCs where available.