CVE-2026-8447

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

CVE-2026-8447

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a stored cross-site scripting vulnerability in the Playground chat interface. The root cause is the MarkdownField component rendering chat messages via the rehypeRaw plugin without a sanitization pass, allowing attacker-controlled LLM respons...

CVE-2026-8447 Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

CVE-2026-8447 Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

PT-2026-85537

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

CVE-2026-8447: Improper Neutralization of Input During Web Page Generation

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

Ai2 Insecure Direct Object Reference

Ai2 is a Seattle based non-profit AI research institute. Ai2 provides a playground web application to chat that is susceptible to an insecure direct object reference vulnerability. An attacker can exploit this IDOR to tamper other users' conversation...