5.3Mittel
CVE-2026-12822langflow-ai langflow Bundle URL Loader code injection
Beschreibung
A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| langflow | langflow | < 1.9.3 | |
| langflow-ai | langflow | 1.9.0, 1.9.1, 1.9.2, 1.9.3 |
Referenzen und Patches
- VDB-372612 | langflow-ai langflow Bundle URL Loader code injection vdb-entryThird Party AdvisoryVDB Entry
- VDB-372612 | CTI Indicators (IOB, IOC, TTP) signatureVDB Entry
- CVE-2026-12822 | CVE Analysis and Report third-party-advisoryThird Party AdvisoryVDB Entry
- Submit #837582 | langflow-ai/langflow - `Langflow bundle URL loading` - `custom component discovery/import path` <=1.9.3 Remote Code Execution / Untrusted Code Loading third-party-advisoryThird Party AdvisoryVDB Entry
- https://github.com/dxz0069/softwareoverflow/blob/main/langflow_bundle_url_custom_component_startup_rce_vulndb.md ExploitMitigationThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*< 1.9.3