CVE-2026-103360

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a Path Traversal vulnerability (CWE-22 ). A remote authenticated attacker can exploit the improper limitation of a pathname to a restricted directory to obtain sensitive information . To remediate this issue, IBM strongly recommends u...

CVE-2026-104334 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation...

CVE-2026-104334

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a critical vulnerability (CVE-2026-104334 ) that allows a remote attacker to execute arbitrary code. This is caused by improper control of code generation (CWE-94). The vulnerability has a CVSS base score of 9.8 , indicating a high im...

CVE-2026-104335 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

CVE-2026-104335 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control...

CVE-2026-104335

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to arbitrary code execution due to improper access control (CWE-284). A remote authenticated attacker can exploit this flaw to execute unauthorized code. The CVSS 3.1 score is 8.8 (HIGH) , indicating high impact on confidentiality, int...

langflow-CVE-2026-17633-PoC

CVE-2026-17633 и CVE-2026-17632 — RCE в IBM Langflow OSS Только в образовательных целях. Используйте только против систем, которыми вы владеете или на тестирование которых у вас есть явное письменное разрешение. 1. Введение Что такое Langflow Langflow — это открытая low-code платформа для создани...

CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow Path Traversal / Arbitrary Directory Deletion PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Description CVE-2026-42048 : Langflow Arbitrary Directory Deletion Vulnerability description: A path traversal vulnerability in...

CVE-2026-12940-Langflow-Unauth-RCE

CVE-2026-12940 — Langflow OSS ≤ 1.10.1 Unauthenticated RCE MCP stdio env-var injection Unauthenticated remote code execution in Langflow OSS through 1.10.1. The environment-variable blocklist that guards MCP stdio server configuration DANGEROUSENVVARS omits SHELLOPTS, BASHOPTS and PS4. Because th...

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Summary Langflow's built-in Python interpreter components — PythonREPLComponent Python Interpreter and the legacy PythonREPLToolComponent Python REPL Tool — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the...

EUVD-2026-38245

Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE Vulnerability xpl0ited by infrar3d This proof‑of‑concept exploit targets a critical Remote Code Execution RCE vulnerability in Langflow versions prior to 1.9.0. The vulnerability allows unauthenticated attackers to execute arbitrary system commands by injecting...

POC-CVE-2026-93674

Описание POC-CVE-2026-93674 Аутентифицированный слепой эксплуатационный код proof of concept для инъекции команд Использование python3 poc.py -u -uname -pword -c -a "" Выполнение PoC Вывод PoC...

IBM-Langflow-CVE-2026-48519-poc

IBM Langflow RCE до аутентификации в Shareable Playgrounds . Работает на версиях -c ""...

CVE-2026-55255-Lab

CVE-2026-55255 - Langflow IDOR in /api/v1/responses Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-55255, an Insecure Direct Object Reference IDOR vulnerability affecting Langflow's OpenAI-compatible Responses API. Langflow is an open-source...

CVE-2026-105741

creationtimestamp| type| source ---|---|--- 2026-10-06 02:28:15+00:00| seen| https://www.acn.gov.it/portale/w/langflow-disponibili-poc-per-lo-sfruttamento-di-4-vulnerabilita...

exposecheck

EXPOSECHECK Only run against servers you own or are authorized to test. Scope: a passing result means only that this narrow check found an authentication challenge and a Langflow version at or above the patched threshold for CVE-2025-3248. It is not a general security, reputation, configuration, ...

CVE-2026-33017

Моя простая реализация CVE-2026-33017 на bash. Подробное объяснение смотрите по следующей ссылке: https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx Используйте nc -lvnp PORT для получения обратного шелла...

PT-2026-107254

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper neutralization of special elements used in an OS command allows a remote, unauthenticated attacker to execute arbitrary code. Approximately 18.8k instances have been identifie...

PT-2026-106365

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper control of code generation allows a remote attacker to execute arbitrary code on the system. Recommendations Upgrade to Langflow version 1.12.3...