Skip to content
OpenAdvisories
High WID-SEC-2026-0823 3 CVEs

Langflow: Mehrere Schwachstellen

Published Mar 22, 2026 · Updated Mar 24, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, und potenziell um Daten zu manipulieren.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 3

  • Critical 9.1
    CVE-2026-33475 Public exploit

    Langflow GitHub Actions Shell Injection

    Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of …

    langflow-ai langflow
  • High 8.7
    CVE-2026-33497 Scanner template EPSS 20%

    Langflow: /profile_pictures/{folder_name}/{file_name} endpoint file reading

    Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the download_profile_picture function of the /profile_pictures/{folder_name}/{file_name} endpoint, the folder_name and file_name parameters are not stric…

    langflow-ai langflow langflow PyPI
  • High 7.5
    CVE-2026-33484

    Langflow has Unauthenticated IDOR on Image Downloads

    Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}` endpoint serves image files without any authentication or ownership check. Any unauthenticated req…

    langflow-ai langflow langflow PyPI

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-14790

  2. #1

    Initiale Fassung

References