dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +2 more potentially affected by CVE-2026-81204 via lfx (>=0.1.13, <=1.11.0.dev50)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =0.7.0, =1.11.0.dev50 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-81204 Source advisory: MEND:CVE-2026-81204...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=1.11.0.dev50) potentially affected by CVE-2026-81941 via lfx (>=1.10.0, <=1.11.0.dev50)

lfx PYPI version =1.10.0, =1.10.0, =0.10.0rc0, =1.11.0.dev50 Source cves: CVE-2026-81941 Source advisory: MEND:CVE-2026-81941...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), jf-langflow (>=1.10.0, <=1.10.0.post7) +2 more potentially affected by CVE-2026-81213 via lfx (>=0.1.13, <=1.11.0.dev50)

lfx PYPI version =0.1.13, =0.6.0, =1.10.0, =0.7.0, =1.11.0.dev50 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-81213 Source advisory: MEND:CVE-2026-81213...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=1.11.0.dev50) potentially affected by CVE-2026-9225 via lfx (>=1.10.0, <=1.11.0.dev50)

lfx PYPI version =1.10.0, =1.10.0, =0.10.0rc0, =1.11.0.dev50 Source cves: CVE-2026-9225 Source advisory: MEND:CVE-2026-9225...

CVE-2026-12940: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

langflow-base-nightly (>=0.5.1.dev4, <=1.10.0.dev9), langflow-nightly (>=1.8.0.dev13, <=1.8.0.dev25) potentially affected by CVE-2026-8505 via lfx-nightly (>=0.1.11.dev0, <=0.5.0.dev9)

lfx-nightly PYPI version =0.1.11.dev0, =0.5.1.dev4, =1.8.0.dev13, =1.8.0.dev25 Source cves: CVE-2026-8505 Source advisory: MEND:CVE-2026-8505...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-8505 via lfx (>=0.1.13, <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-8505 Source advisory: MEND:CVE-2026-8505...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by CVE-2026-10561 via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: CVE-2026-10561 Source advisory: MEND:CVE-2026-10561...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-55447 via lfx (>=0.1.13, <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-55447 Source advisory: SNYK:PYTHON-LFX-17400345...

dzbanek-langflow-base (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-55423 via lfx (0.1.13)

lfx PYPI version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - dzbanek-langflow-base =0.6.0, =0.6.1 Source cves: CVE-2026-55423 Source advisory: SNYK:PYTHON-LFX-17400336...

Insufficient Session Expiration

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Insufficient Session Expiration in the logout. An attacker can maintain unauthorized access to a user's session by...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-55450 via lfx (>=0.1.13, <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-55450 Source advisory: SNYK:PYTHON-LFX-17400159...

Missing Authentication for Critical Function

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the createuploadfile function. An attacker can exhaust server disk space...

jf-langflow (>=1.10.0, <=1.10.0.post7), langflow-base (>=0.10.0rc0, <=0.10.0) potentially affected by CVE-2026-7700 via lfx (1.10.0)

lfx PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - jf-langflow =1.10.0, =0.10.0rc0, =0.10.0 Source cves: CVE-2026-7700 Source advisory: SNYK:PYTHON-LFX-16479357...

Arbitrary Command Injection

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Arbitrary Command Injection via the parsecallabledetails function in codeparser.py. An attacker can execute arbitrary syst...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.7.3) +1 more potentially affected by CVE-2026-27966 via lfx (>=0.1.13, <=0.2.2)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.7.3 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-27966 Source advisory: SNYK:PYTHON-LFX-15357988...

Unsafe Dependency Resolution

Overview lfx is a lfx is a command-line tool for running Langflow workflows. It provides two main commands: serve and run. Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the execglobals parameter in the validate endpoint. An attacker can execute arbitrary cod...

dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-0770 via lfx (>=0.1.13, <=0.3.4)

lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-0770 Source advisory: SNYK:PYTHON-LFX-15091579...