lfx vulnerabilities (PyPI)

2 vulnerabilities.

• lfx PyPI Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling) GHSA-j8f7-x8jm-wmm4 Fix available 6.3 MediumOctober 6, 2026
• lfx PyPI Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration CVE-2026-105697 Public exploitFix available 9.9 CriticalOctober 5, 2026