langflow-base vulnerabilities (PyPI)
8 vulnerabilities.
-
langflow-basePyPI Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling) 6.3 Medium -
langflow-basePyPI Langflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints 5.4 Medium -
langflow-basePyPI Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration 9.9 Critical -
langflow-basePyPI langflow-ai langflow API Endpoint endpoints.py create_upload_file unrestricted upload 6.9 Medium -
langflow-basePyPI Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check 8.7 High -
langflow-basePyPI Langflow Missing Authentication on Critical API Endpoints 8.8 High -
langflow-basePyPI Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation 8.8 High -
langflow-basePyPI Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code 9.8 Critical