Medium · 6.1 CVE-2026-8447 EUVD-2026-71216GHSA-342j-xgq4-rg29

Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

Published Sep 4, 2026 · Updated Sep 4, 2026 · Assigned by ibm

Vendor: IBM Product: Langflow OSS

Description

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

Affected products

Vendor	Product	Affected	Fixed
IBM	Langflow OSS	1.0.0 – ≤ 1.11.2	—

Advisories 1

WID-SEC-2026-3096 Langflow OSS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 14, 2026

References

https://www.ibm.com/support/pages/node/7285646 vendor-advisory patch