pypi

langflow

65 Total advisories

65 Vulnerabilities

0 Malware

Dependency scanning

Check whether langflow is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

langflow

Vulnerabilities

Langflow: Unauthenticated RCE in Shareable Playgrounds

Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check

Langflow vulnerable to injection

Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

Langflow Missing Authentication on Critical API Endpoints

Langflow Missing Authentication on Critical API Endpoints

Langflow has an Information Leak through Incomplete API Key Redaction

Langflow vulnerable to injection

Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint

Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint

Langflow has an Information Leak through Incomplete API Key Redaction

Langflow Knowledge Bases API is Vulnerable to Path Traversal

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

CVE-2025-57760

Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE)

Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow

Langflow vulnerable to remote code execution

Inefficient Regular Expression Complexity in langflow

Langflow affected by Remote Code Execution via validate_code() exec()

Langflow vulnerable to Server-Side Request Forgery

Langflow vulnerable to remote code execution

Inefficient Regular Expression Complexity in langflow

Langflow vulnerable to Server-Side Request Forgery

Langflow affected by Remote Code Execution via validate_code() exec()

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Langflow has Remote Code Execution in CSV Agent

Langflow has Remote Code Execution in CSV Agent

Langflow Knowledge Bases API is Vulnerable to Path Traversal

CVE-2025-3248

Langflow Unauth RCE

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint

CVE-2026-48519

CVE-2026-48520

CVE-2026-33760

Langflow: Unauthenticated DoS through multipart form boundary file upload

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

Langflow: Logout button does not clear session

CVE-2026-55423

CVE-2026-55255

CVE-2026-55450

CVE-2026-55446

CVE-2024-37014

CVE-2025-34291

CVE-2024-42835

langflow has Unauthenticated IDOR on Image Downloads

Langflow has Authenticated Code Execution in Agentic Assistant Validation

Langflow is Missing Ownership Verification in API Key Deletion (IDOR)

Langflow has an Arbitrary File Write (RCE) via v2 API

langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

External Control of File Name or Path in Langflow

langflow has vulnerability in PythonCodeTool component

Langflow CORS misconfiguration enables Account Takeover and RCE

CVE-2026-33873

CVE-2026-33497

CVE-2026-33484

CVE-2026-33309

CVE-2026-33053

CVE-2025-68478

Duplicate Advisory: Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint

Langflow remote code execution vulnerability

Browse more PyPI advisories

Start Securing