CVE-2026-8447: Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust
IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.
Other sources
Langflow OSS suffer from a stored cross-site scripting vulnerability in the Playground chat interface.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.11.3 - Compensating control
Because Langflow is vulnerable to IP spoofing due to untrusted proxy header trust, ensure any reverse proxy/load balancer only passes trusted proxy headers to Langflow (do not trust client-supplied proxy headers; configure trusted proxy settings appropriately).
- Compensating control
Because Langflow is vulnerable to stored cross-site scripting due to unsanitized Markdown rendering in the Playground chat interface, restrict/limit access to the Playground chat interface (e.g., to authenticated users or trusted networks) until upgraded to 1.11.3.
Event History
Frequently Asked Questions
Who is exposed to the stored XSS issue?
Users of the Playground chat interface are exposed when they view attacker-controlled content that has been stored and rendered as Markdown. The CVSS vector indicates exploitation requires user interaction.
Does an attacker need an account or elevated privileges to exploit this?
The CVSS vector lists network access, low attack complexity, and no privileges required. An attacker can target the affected interface remotely without prior privileges, but successful exploitation still depends on a user interacting with the stored content.
What is the expected impact of a successful exploit?
The supplied CVSS vector rates confidentiality and integrity impact as low and availability impact as none. The overall severity is medium, with a score of 6.1.