●PocketClawAI security alerts
Sign in
criticalCVSS 9.9NVD status: Analyzed

CVE-2026-33309

Langflow is a tool for building and deploying AI-powered agents and workflows.

ComponentLangflow
Severitycritical (CVSS 9.9)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published (NVD)2026-03-24
Last modified2026-06-17
Affected versions
langflow >= 1.2.0, < 1.9.0
Fixed in1.9.0
WeaknessCWE-22CWE-73CWE-94CWE-284
CISA KEVnot listed

NVD description

Langflow is a tool for building and deploying AI-powered agents and workflows. Versions 1.2.0 through 1.8.1 have a bypass of the patch for CVE-2025-68478 (External Control of File Name), leading to the root architectural issue within `LocalStorageService` remaining unresolved. Because the underlying storage layer lacks boundary containment checks, the system relies entirely on the HTTP-layer `ValidatedFileName` dependency. This defense-in-depth failure leaves the `POST /api/v2/files/` endpoint vulnerable to Arbitrary File Write. The multipart upload filename bypasses the path-parameter guard, allowing authenticated attackers to write files anywhere on the host system, leading to Remote Code Execution (RCE). Version 1.9.0 contains an updated fix.

Does CVE-2026-33309 hit the version you run?Paste your docker-compose.yml, requirements.txt or package.json. The scanner checks your pinned versions against this CVE and every other one we track for Langflow.
Check my stack

What to do

  • Upgrade Langflow to 1.9.0 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more

Other Langflow CVEs

high
CVE-2026-88962CVSS 8.8

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code...

Langflow
2026-10-07high
CVE-2026-93445CVSS 8.1

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of gener...

Langflow
2026-10-07high
CVE-2026-103360CVSS 8.1

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation...

Langflow
2026-10-07critical
CVE-2026-104334CVSS 9.8

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Langflow
2026-10-07high
CVE-2026-93443CVSS 7.5

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization o...

Langflow
2026-10-07high
CVE-2026-93447CVSS 7.5

IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious...

Langflow
2026-10-07

All Langflow CVEs