langflow-base vulnerabilities

2 known vulnerabilities in langflow-base from Langflow-ai. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  langflow: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-105697Oct 5, 2026Langflow-aiEPSS 1.49%

  Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c

• 8.8 High severity

  langflow: Authorization Bypass Through User-Controlled Key

  CVE-2026-34046Mar 27, 2026Langflow-ai

  Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filter by `user_id`. When `A