Directory Traversal

Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Directory Traversal via the deleteknowledgebasesbulk function. An attacker can delete arbitrary directories on the server's filesystem by supplying crafted input to the...

Langflow Knowledge Bases API is Vulnerable to Path Traversal

Summary Langflow is vulnerable to Path Traversal in the Knowledge Bases API DELETE /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit thi...

CVE-2026-7700

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

CVE-2026-7687

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command...

GHSA-HHXR-7J22-694R Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9fpm-3445-2vx4. This link is maintained to preserve external references. Original Description A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file...

Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9fpm-3445-2vx4. This link is maintained to preserve external references. Original Description A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file...

Arbitrary Code Injection

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Arbitrary Code Injection via the eval function in the LambdaFilterComponent component. An attacker can execute arbitrary...

CVE-2026-7700

A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.py of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

CVE-2026-7700 langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection

A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.py of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

CVE-2026-7700 langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection

A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.py of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

CVE-2026-7700

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

CVE-2026-7700

Langflow-ai Langflow up to v1.8.4 is affected by a code injection in the LambdaFilterComponent’s eval function (src/lfx/src/lfx/components/llm_operations/lambda_filter.p). The underlying issue is unsafe evaluation of input, enabling remote exploitation. The CVE indicates the attack can be perform...

CVE-2026-7700 langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection

A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llmoperations/lambdafilter.py of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +40 more potentially affected by CVE-2026-7687 via lfx (>=0.1.13, <=1.13.0.dev33)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =1.8.0rc0, =0.7.0, =0.1.0, =0.1.0, =0.1.1rc0, =1.0.0, =0.1.0, =0.1.4 - lfx-confluent 0.1.0 - lfx-darkmoon 0.1.0 and more Source cves: CVE-2026-7687 Source advisory: SNYK:PYTHON-LFX-16479355...

CVE-2026-7687

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command...

EUVD-2026-26825

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command...

CVE-2026-7687

LangFlow (langflow) up to version 1.8.4 is affected by a command-injection vulnerability in CodeParser.parse_callable_details (file src/lfx/src/lfx/custom/code_parser/code_parser.py, component Full Builtins Module Handler). The issue can be triggered remotely and an exploit has been publicly disc...

CVE-2026-7687 langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command...

CVE-2026-7687

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command...

CVE-2026-7687 langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command...