langflow-base (>=0.9.0, <=0.9.6) potentially affected by CVE-2026-105697 +1 more via lfx (0.4.6)

lfx PYPI version 0.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.9.0, =0.9.6 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 +1 more via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

langflow-base (>=0.8.0rc0, <=0.8.4) potentially affected by CVE-2026-105697 +1 more via lfx (0.3.4)

lfx PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - langflow-base =0.8.0rc0, =0.8.4 Source cves: CVE-2026-105697, CVE-2026-105740 Source advisory: OSV:GHSA-W794-RJ3P-XV45...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105740 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105740 Source advisory: MEND:CVE-2026-105740...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105698 via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105698 Source advisory: MEND:CVE-2026-105698...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-105697 via langflow-base (>=0.7.2, <=0.10.0)

langflow-base PYPI version =0.7.2, =1.10.0, =1.10.0.post7 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697 Source advisory: MEND:CVE-2026-105697...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +2 more potentially affected by CVE-2026-105697 via lfx (>=0.1.13, <=1.10.0)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =0.7.0, =0.10.0 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-105697 Source advisory: MEND:CVE-2026-105697...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +39 more potentially affected by CVE-2026-48155 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-6596 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6596 Source advisory: OSV:PYSEC-2026-2572...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +39 more potentially affected by CVE-2026-40260 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the logout. An attacker can maintain unauthorized access to a user's session by exploiting improper clearing of authentication cookies and tokens after logout. This may allow continued access to...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getflowbyidorendpointname function. An attacker can access and execute flows belonging to other users, potentially exposing sensitive data and consuming resources, by specifying t...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the createuploadfile function. An attacker can exhaust server disk space and obtain sensitive file system information by uploading arbitrary files without authentication and receiving...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the monitor API endpoints, which lack proper ownership enforcement. An attacker can read, modify, rename, or permanently delete another user's messages, sessions, build artifacts, and...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-6596 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6596 Source advisory: SNYK:PYTHON-LANGFLOWBASE-16110820...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the createuploadfile function. An attacker can upload arbitrary files by sending crafted requests to the affected API endpoint. Remediation Upgrade langflow-base to version 0.8.0 or higher. References - GitHub...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-6596 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6596 Source advisory: OSV:GHSA-VVFC-FP59-M92G...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the readflow helper in src/backend/base/langflow/api/v1/flows.py. An attacker can read, modify, or delete another user's flow by supplying that flow's UUID to the GET, PATCH, or DELETE /api/v1/flow/flowid...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the downloadimage endpoint. An attacker can access and download image files belonging to any flow by knowing or guessing the flow ID and file name. Remediation There is no fixed version for langflow-base...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the deleteapikeyroute endpoint. An attacker can delete API keys belonging to other users by providing the apikeyid of a key they do not own. Remediation Upgrade langflow-base to versio...