CVE-2025-34291 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration alloworigins='' with allowcredentials=True combined with a refresh token cookie configured as SameSite=None allows a malicio...

CVE-2025-34291 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration alloworigins='' with allowcredentials=True combined with a refresh token cookie configured as SameSite=None allows a malicio...

PT-2025-49321

Name of the Vulnerable Software and Affected Versions Langflow versions prior to 1.7.0 Description A chained issue enables account takeover and remote code execution. An overly permissive Cross-Origin Resource Sharing CORS configuration, where allow origins is set to '' and allow credentials is s...

Langflow Access Control Vulnerability

Langflow is a Langflow open source visualization framework for building multi-agent and RAG applications. An access control error vulnerability exists in Langflow 1.6.9 and earlier versions, which stems from overly lax CORS configuration and improper SameSite settings that could lead to account...

CVE-2025-34291: Origin Validation Error

Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration alloworigins='' with allowcredentials=True combined with a refresh token cookie configured as SameSite=None allows a malicio...

Exploit for Missing Authentication for Critical Function in Langflow

-CVE-2025-3248 A comprehensive Python...

Exploit for Missing Authentication for Critical Function in Langflow

CVE-2025-3248: Langflow Unauthenticated RCE Vulnerability Scan...

Exploit for Missing Authentication for Critical Function in Langflow

CVE-2025-3248 Langflow RCE Scanner A Python tool designed to...

EUVD-2025-32968

Malicious code in langflow-api-chat npm...

Malicious code in langflow-api-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0d493794349f9fd072b31947424562afcd5b86b1fd642a42cf613d4b363f5cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview langflow-api-chat is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in langflow-api-chat

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-48030 Malicious code in langflow-api-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0d493794349f9fd072b31947424562afcd5b86b1fd642a42cf613d4b363f5cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-25750

Malicious code in bioql PyPI...

EUVD-2024-2701

Malicious code in bioql PyPI...

EUVD-2024-48240

Malicious code in bioql PyPI...

Exploit for Code Injection in Langflow

It is an offensive tool for web exploitation. The target product...

Privilege Escalation

langflow is vulnerable to privilege escalation. The vulnerability is due to improper access control in Langflow containers, where an authenticated user with RCE access can invoke the internal langflow superuser CLI command to create an administrative account, which allows an attacker to gain full...

Exploit for Code Injection in Langflow

CVE-2025-3248 Introduction Langflow versions prior to 1.3...

CVE-2025-57760

Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command langflow superuser to create a new administrative user. This results in...