Read the docs
TI-2026-40013 Aliases CVE-2026-55447GHSA-ccv6-r384-xp75

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Priority MEDIUM 44CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files that are digested into the RAG, an attacker can direct the node to read any file on the file-system by absolute path. All components based on BaseFileComponent are vulnerable to the vulnerability. This includes Docling (DoclingInlineComponent), Docling Serve, DoclingRemoteComponent), Read File (FileComponent), NVIDIA Retriever Extraction (NvidiaIngestComponent), Video File (VideoFileComponent), and Unstructured API (UnstructuredComponent). This vulnerability is fixed in 1.9.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00662 51st percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed langflow (langflow-ai): 1.9.2langflow (PyPI): 1.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Langflowlangflowbefore 1.9.21.9.2Patch availableCNA
—langflow (PyPI)before 1.9.21.9.2Patch availableGHSA-ccv6-r384-xp75
  • langflow VendorLangflow Affected before 1.9.2 Fixed in 1.9.2 Patch available CNA
  • langflow (PyPI) Vendor— Affected before 1.9.2 Fixed in 1.9.2 Patch available GHSA-ccv6-r384-xp75

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*before 1.9.2VulnerableLangflow
  • cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* Versions before 1.9.2 Vulnerable ·Langflow

Remediation

  • Fix · CNA langflow (langflow-ai) Fixed in 1.9.2
  • Fix · GHSA-ccv6-r384-xp75 langflow (PyPI) Fixed in 1.9.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55447
  2. 2026-10-03 Alias added: GHSA-ccv6-r384-xp75
  3. 2026-10-06 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 1

Other 1

  • TI-2026-08085 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-00553 Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote… KEVCVSS 3.0CRITICAL 9.8
  • TI-2025-24427 Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE KEVCVSS 4.0CRITICAL 9.4
  • TI-2025-02845 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-25463 Langflow has Unauthenticated Remote Code Execution via Public Flow Build Endpoint KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-39928 Authorization bypass in langflow KEVCVSS 3.1HIGH 8.4
See all 216 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences