5.3Orta
CVE-2026-12822langflow-ai langflow Bundle URL Loader code injection
Açıklama
A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| langflow | langflow | < 1.9.3 | |
| langflow-ai | langflow | 1.9.0, 1.9.1, 1.9.2, 1.9.3 |
Kaynaklar ve yamalar
- VDB-372612 | langflow-ai langflow Bundle URL Loader code injection vdb-entryThird Party AdvisoryVDB Entry
- VDB-372612 | CTI Indicators (IOB, IOC, TTP) signatureVDB Entry
- CVE-2026-12822 | CVE Analysis and Report third-party-advisoryThird Party AdvisoryVDB Entry
- Submit #837582 | langflow-ai/langflow - `Langflow bundle URL loading` - `custom component discovery/import path` <=1.9.3 Remote Code Execution / Untrusted Code Loading third-party-advisoryThird Party AdvisoryVDB Entry
- https://github.com/dxz0069/softwareoverflow/blob/main/langflow_bundle_url_custom_component_startup_rce_vulndb.md ExploitMitigationThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*< 1.9.3