Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload via the createuploadfile function. An attacker can upload arbitrary files by sending crafted requests to the affected API endpoint. Remediation Upgrade langflow-base to version 0.8.0 or higher. References - GitHub...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-6596 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6596 Source advisory: GHSA-VVFC-FP59-M92G...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-6596 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6596 Source advisory: OSV:GHSA-VVFC-FP59-M92G...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-6596 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-6596 Source advisory: MEND:CVE-2026-6596...

langflow-base (>=0.0.90, <=0.0.92), ragstack-ai-langflow-base (1.0.14.post0) potentially affected by CVE-2026-34070 via langchain-core (0.2.23)

langchain-core PYPI version 0.2.23 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langflow-base =0.0.90, =0.0.92 - ragstack-ai-langflow-base 1.0.14.post0 Source cves: CVE-2026-34070 Source advisory:...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33873 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33873 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15812241...

langflow-base (>=0.0.90, <=0.0.92), ragstack-ai-langflow-base (1.0.14.post0) potentially affected by CVE-2026-34070 via langchain-core (0.2.23)

langchain-core PYPI version 0.2.23 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langflow-base =0.0.90, =0.0.92 - ragstack-ai-langflow-base 1.0.14.post0 Source cves: CVE-2026-34070 Source advisory:...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the readflow helper in src/backend/base/langflow/api/v1/flows.py. An attacker can read, modify, or delete another user's flow by supplying that flow's UUID to the GET, PATCH, or DELETE /api/v1/flow/flowid...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-5027 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-5027 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15842030...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the downloadimage endpoint. An attacker can access and download image files belonging to any flow by knowing or guessing the flow ID and file name. Remediation There is no fixed version for langflow-base...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-5026 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-5026 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15814086...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33484 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33484 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15746998...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33053 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33053 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15701926...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the deleteapikeyroute endpoint. An attacker can delete API keys belonging to other users by providing the apikeyid of a key they do not own. Remediation Upgrade langflow-base to versio...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33309 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33309 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15702032...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path in the POST /api/v2/files/ endpoint. An attacker can execute arbitrary code, overwrite critical files, or gain unauthorized access by uploading files with crafted filenames that bypass containment...

langflow-nightly (1.8.0.dev24) potentially affected by CVE-2026-33017 via langflow-base (0.7.2)

langflow-base PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on langflow-base and may be impacted: - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-33017 Source advisory: SNYK:PYTHON-LANGFLOWBASE-15680351...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the POST /api/v1/buildpublictmp/flowid/flow endpoint when attacker-controlled flow data is supplied to the data parameter, which is then executed using exec without authentication or...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +38 more potentially affected by CVE-2026-27888 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.7.3) +1 more potentially affected by CVE-2026-27966 via lfx (>=0.1.13, <=0.2.2)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.7.3 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-27966 Source advisory: SNYK:PYTHON-LFX-15357988...