IBM Langflow Desktop versions 1.6.0 through 1.8.4 are affected by a stored cross-site scripting (XSS) vulnerability. This flaw allows an authenticated user to inject arbitrary JavaScript code into the web user interface, potentially altering its intended functionality and leading to credential disclosure within a trusted session.