{"data":{"id":"27cb2db8-d2b1-4dc7-8812-15f56e9e52f2","title":"CVE-2025-57760: Langflow is a tool for building and deploying AI-powered agents and workflows. A privilege escalation vulnerability…","summary":"CVE-2025-57760 is a privilege escalation flaw in Langflow containers, a tool for building and deploying AI-powered agents and workflows. An authenticated user with RCE access can run the internal CLI command langflow superuser to create a new administrative user, gaining full superuser access even if they registered through the UI as a regular account. The weakness is classified as CWE-269, Improper Privilege Management.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-57760","publishedAt":"2025-08-25T21:15:30.140Z","cveId":"CVE-2025-57760","cweIds":["CWE-269"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["langflow@<= 1.5.0 (fixed: 1.5.1)","langflow-base@<= 0.5.0 (fixed: 0.5.1)"],"affectedPackageNames":["langflow","langflow-base"],"affectedPackageRefs":["pypi:langflow","pypi:langflow-base"],"affectedVendors":[],"affectedVendorsRaw":["Langflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Langflow privilege escalation in containers via langflow superuser CLI command","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00539,"epssCheckedAt":"2026-11-04T00:12:27.579Z","kevDateAdded":null,"advisoryAliases":["GHSA-4gv9-mp8m-592r"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:53.224Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-08-28T16:00:09.016Z","daysToFix":3,"fixCheckedAt":"2026-10-29T21:43:53.101Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"langflow-base","fixedVersion":"0.5.1","matchedVersion":"0.5.1","fixReleasedAt":"2025-08-28T16:00:09.016Z","daysToFix":3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:52.950Z"},{"ecosystem":"pypi","name":"langflow","fixedVersion":"1.5.1","matchedVersion":"1.5.1","fixReleasedAt":"2025-08-28T16:10:58.220Z","daysToFix":3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:43:52.950Z"}]}}