CVE-2026-5026: Langflow - Stored XSS via Malicious SVG Upload
The '/api/v1/files/images/{flowid}/{filename}' endpoint serves SVG files with the 'image/svg+xml' content type without sanitizing their content.
Since SVG files can contain embedded JavaScript, an attacker can upload a malicious SVG that executes arbitrary JavaScript when viewed by other users, leading to stored cross-site scripting (XSS). This allows stealing authentication tokens stored in cookies, including JWT access and refresh tokens.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5026?
CVE-2026-5026 is a high severity vulnerability due to its potential for executing arbitrary JavaScript through stored XSS.
How do I fix CVE-2026-5026?
To fix CVE-2026-5026, ensure that SVG uploads are properly sanitized to remove any embedded scripts before processing.
What type of attack is associated with CVE-2026-5026?
CVE-2026-5026 is associated with a stored cross-site scripting (XSS) attack via malicious SVG file uploads.
Which software is affected by CVE-2026-5026?
CVE-2026-5026 affects the Langflow software when handling SVG file uploads through its API.
How can an attacker exploit CVE-2026-5026?
An attacker can exploit CVE-2026-5026 by uploading a malicious SVG file that contains JavaScript, which executes when the file is served.