PT-2026-51264 · Langflow Ai · Langflow

St4R · Publicado 2026-06-21 · Atualizado 2026-06-22 · CVE-2026-12822

Mitre

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.

Correção

Special Elements Injection

Code Injection

Enumeração de Fraquezas

CWE-74

CWE-94

Identificadores relacionados

CVE-2026-12822

Produtos afetados

Langflow

Referências · 6

• https://vuldb.com/vuln/372612/cti · Nota
• https://github.com/dxz0069/softwareoverflow/blob/main/langflow_bundle_url_custom_component_startup_rce_vulndb.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-12822 · Nota de Segurança
• https://vuldb.com/submit/837582 · Nota
• https://vuldb.com/vuln/372612 · Nota
• https://vuldb.com/cve/CVE-2026-12822 · Nota