PyPI/lfx: medium

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Action: Upgrade lfx to 1.10.3 or later.

pip install lfx==1.10.3

Affected

Fixed versions

Sources

• osv: GHSA-j8f7-x8jm-wmm4#PyPI/lfx
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-j8f7-x8jm-wmm4
• https://github.com/langflow-ai/langflow/pull/13016
• https://github.com/langflow-ai/langflow/pull/13395
• https://github.com/langflow-ai/langflow/pull/13643
• https://github.com/langflow-ai/langflow/pull/14033
• https://github.com/langflow-ai/langflow/pull/14071
• https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639
• https://github.com/langflow-ai/langflow
• https://github.com/langflow-ai/langflow/releases/tag/v1.10.3

published 2026-10-06T13:39:57Z · modified 2026-10-06T13:45:06.468251407Z · JSON