Langflow Multiple Vulnerabilities Allow File Manipulation, Information Disclosure, XSS

CERT-Bund issued a security advisory identifying multiple vulnerabilities in Langflow, an open-source platform for creating LLM-based applications via a visual interface. The vulnerabilities affect versions prior to 1.1.0 and prior to 1.8.3 across multiple operating systems. An unauthenticated remote attacker can exploit these flaws to manipulate files, expose sensitive information, or conduct cross-site scripting attacks.

Organizations running Langflow deployments should upgrade to version 1.1.0 or 1.8.3 (whichever is applicable) and apply available mitigations. Security teams should audit file access controls and input sanitisation on Langflow instances, particularly those exposed to untrusted networks.