CVE-2026-5026

🗓️ 27 Mar 2026 14:50:36Reported by tenableType

cve🔗 web.nvd.nist.gov👁 3 Views🌐 WEB

Langflow stored cross site scripting via malicious SVG upload to /api/v1/files/images/{flow_id}/{file_name}, enabling token theft.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-5026	27 Mar 202614:50	–	attackerkb
Circl	CVE-2026-5026	27 Mar 202617:22	–	circl
CNNVD	Langflow 安全漏洞	27 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-5026 Langflow - Stored XSS via Malicious SVG Upload	27 Mar 202614:50	–	cvelist
EUVD	EUVD-2026-16666	27 Mar 202615:30	–	euvd
NVD	CVE-2026-5026	27 Mar 202615:17	–	nvd
Positive Technologies	PT-2026-28740	27 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-5026	28 Mar 202616:59	–	redhatcve
Snyk	Cross-site Scripting (XSS)	27 Mar 202617:31	–	snyk
vulnersOsv	langflow-nightly (=1.8.0.dev24) potentially affected by CVE-2026-5026 via langflow-base (=0.7.2)	27 Mar 202617:31	–	vulnersosv

NVD

Node

langflow langflowMatch-

[
  {
    "vendor": "langflow-ai",
    "product": "langflow",
    "repo": "https://github.com/langflow-ai/langflow",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2026-25

Parameter	Position	Path	Description	CWE
flow_id	path	/api/v1/files/images/{flow_id}/{file_name}	Stored XSS via unsanitized SVG content served as image/svg+xml, allowing injected JavaScript to execute when viewed by other users.	CWE-79
file_name	path	/api/v1/files/images/{flow_id}/{file_name}	Stored XSS via unsanitized SVG content served as image/svg+xml, allowing injected JavaScript to execute when viewed by other users.	CWE-79

20 Apr 2026 13:04Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.4

CVSS 47

EPSS0.00052

SSVC

CWE-79