CVE-2026-12822: langflow-ai langflow Bundle URL Loader code injection
Published Jun 21, 2026
·Updated
A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
2 affected components
pypi/langflow<=1.9.3
Langflow Langflow<1.9.3
Event History
Jun 21, 2026
CVE Published
via MITRE·11:30 PM
Data Sourced
via MITRE·11:30 PM
DescriptionSeverityWeakness
Jun 22, 2026
Data Sourced
via NVD·12:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-12822?
CVE-2026-12822 has a medium severity rating of 5.3.
2
How does CVE-2026-12822 affect langflow-ai langflow?
CVE-2026-12822 affects the Bundle URL Loader component, allowing for code injection.
3
What is the risk posed by CVE-2026-12822?
CVE-2026-12822 poses a risk of code injection when the vulnerability is exploited locally.
4
How can I mitigate the impact of CVE-2026-12822?
To mitigate CVE-2026-12822, users should upgrade langflow-ai langflow to a secured version beyond 1.9.3.
5
Is CVE-2026-12822 a remotely exploitable vulnerability?
No, CVE-2026-12822 requires local access to exploit the code injection vulnerability.