Threats affecting pkg:pypi/langflow-ai/langflow

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

CVE-2026-33309 is a critical path traversal vulnerability in langflow versions 1.2.0 through 1.8.1. It arises from an architectural flaw in the LocalStorageService where boundary checks are missing, allowing an authenticated attacker to bypass filename validation on the POST /api/v2/files/ endpoint. This enables arbitrary file write anywhere on the host system, potentially leading to remote code execution without user interaction. The vulnerability stems from a failed patch for a previous related issue (CVE-2025-68478) and is fixed in version 1.9.0.

Langflow's CSV Agent node hardcodes the parameter allow_dangerous_code=True, enabling LangChain's python_repl_ast tool. This allows remote attackers to execute arbitrary Python and OS commands on the server via crafted prompts, resulting in full remote code execution (RCE). There is no current configuration option to disable this behavior. Versions up to 1.8.0rc2 are affected. A proof of concept demonstrates creating a file on the server via this vulnerability.

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories, and perform destructive operations including message deletion. This affects endpoints handling personal data and system operations that should require proper authorization. Version 1.7.0.dev45 contains a patch.

Langflow versions prior to 1.3.0 contain a critical remote code execution vulnerability in the /api/v1/validate/code endpoint. This flaw allows unauthenticated attackers to send crafted HTTP requests that execute arbitrary code on the affected system. The vulnerability is identified as CVE-2025-3248 and has a CVSS 4.0 base score of 9.3, indicating a critical severity. Fixed versions 1.3.0 and 0.3.0 are available. Public exploit code exists, including Metasploit and Exploit-DB modules, and detection templates are available via Nuclei. No known exploitation in the wild has been reported.

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.