Skip to content
OpenAdvisories
High WID-SEC-2026-4226 7 CVEs

Langflow: Mehrere Schwachstellen

Published Oct 28, 2026 · Updated Oct 29, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 7

  • Critical 9.8
    CVE-2026-110186 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-93680 Public exploit

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

    IBM Langflow OSS
  • High 8.8
    CVE-2026-110193

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command…

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-110192

    Langflow OSS is affected by multiple vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-84365

    Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory

    Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output direc…

    honojs hono hono npm
  • Medium 5.9
    CVE-2026-84363

    Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that…

    honojs hono hono npm
  • Medium 5.3
    CVE-2026-84364

    Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the to…

    honojs hono hono npm

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-113155, EUVD-2026-113134, EUVD-2026-113132, EUVD-2026-113131

  2. #1

    Initiale Fassung

References