GHSA-ccv6-r384-xp75: Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Summary

All components built on BaseFileComponent in Langflow are vulnerable, including the Read File node, which processes user-controlled files. A crafted tar archive containing a symlink, extracted in _unpack_bundle, lets an attacker read any file by absolute path, such as Langflow's secret_key used to sign JWTs. With that key an attacker can forge tokens for any user and execute code through a Python Interpreter node. Any user ingesting untrusted data with these components is affected, and the code execution risk depends on the scenario.

Mitigation

Fixed in 1.9.2 via PR #12945. BaseFileComponent._unpack_bundle now rejects symlink and hardlink members and any non-regular entries during TAR extraction, with additional symlink filtering during directory recursion and after extraction. Upgrade to 1.9.2 or later.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• langflowPyPIReaches an LLM package through dependencies

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online