langflow-base
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 15 advisory(ies) without a verdict
Advisories (15)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-4gv9-mp8m-592r Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) | < 0.5.1 | Undetermined |
| GHSA-8c4j-f57c-35cf Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check | < 0.5.1 | Undetermined |
| GHSA-c5cp-vx83-jhqx Langflow Missing Authentication on Critical API Endpoints | < 0.7.1 | Undetermined |
| GHSA-gh98-4phw-6fmw Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints | < 0.10.1 | Undetermined |
| GHSA-j8f7-x8jm-wmm4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling) | < 0.10.3 | Undetermined |
| GHSA-rvqx-wpfh-mfx7 Langflow Unauth RCE | < 0.3.0 | Undetermined |
| GHSA-vvfc-fp59-m92g Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API | < 0.9.1 | Undetermined |
| GHSA-w794-rj3p-xv45 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | 0.1.2 – < 0.10.3 | Undetermined |
| PYSEC-2026-1526 Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (Post-RCE) | < 0.5.1 | Undetermined |
| PYSEC-2026-2570 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check | < 0.5.1 | Undetermined |
| PYSEC-2026-2571 Langflow Missing Authentication on Critical API Endpoints | < 0.7.1 | Undetermined |
| PYSEC-2026-2572 Langflow: DoS Through Lack of File Size Restriction via Deprecated Unauthenticated File Upload API | < 0.9.1 | Undetermined |
| PYSEC-2026-380 Langflow Unauth RCE | < 0.3.0 | Undetermined |
| PYSEC-2026-4238 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints | < 0.10.1 | Undetermined |
| PYSEC-2026-4239 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | 0.1.2 – < 0.10.3 | Undetermined |
Sources
| Source | Licence |
|---|