Threats affecting pkg:github/langflow

CVE-2026-101861 is a low severity vulnerability in langflow versions 0.0.94 through before 1.12.0 and 1.0.16 through before 1.12.0. It involves unsafe use of Python's eval() function in schema.py, allowing authenticated users to execute arbitrary code by injecting malicious Python objects with crafted __repr__ methods into component input options. The vulnerability is triggered when components are converted into LangChain tools, including during API-based custom component saves.

Langflow suffers from an origin validation error vulnerability due to an overly permissive CORS configuration combined with a refresh token cookie set as SameSite=None. This flaw allows malicious webpages to perform cross-origin requests with credentials, enabling calls to the refresh endpoint. Exploitation can lead to arbitrary code execution and full system compromise by leveraging obtained tokens that grant access to authenticated endpoints.

CVE-2026-5027 is a high-severity vulnerability in langflow-ai's langflow product. The issue occurs in the 'POST /api/v2/files' endpoint, where the 'filename' parameter is not properly sanitized. This allows attackers with limited privileges to perform path traversal attacks and write files to arbitrary locations on the filesystem.

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content. Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication ('get_current_active_user') without any privilege checks (e.g., 'is_superuser').

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

Langflow has a critical missing authentication vulnerability in the /api/v1/validate/code endpoint. This flaw allows remote, unauthenticated attackers to execute arbitrary code by sending crafted HTTP requests. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. It is known to be exploited in the wild and has been linked to ransomware campaigns. No specific affected versions or patches are provided in the available data.