CVE-2026-6600: langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting
A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/chatMessage/components/edit-message.tsx of the component Frontend React Component Rendering. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6600?
CVE-2026-6600 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2026-6600?
To fix CVE-2026-6600, upgrade the langflow-ai langflow package to version 1.8.4 or above.
What are the consequences of CVE-2026-6600?
CVE-2026-6600 can lead to unauthorized script execution, compromising user data and session integrity.
Who is affected by CVE-2026-6600?
CVE-2026-6600 affects all users of langflow-ai langflow versions up to and including 1.8.3.
What type of vulnerability is CVE-2026-6600?
CVE-2026-6600 is a cross-site scripting (XSS) vulnerability found in the React component rendering of langflow.