PyPI/lfx-docling: medium

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)

Action: Upgrade lfx-docling to 0.1.2 or later.

pip install lfx-docling==0.1.2

Affected

Fixed versions

Sources

• osv: GHSA-j8f7-x8jm-wmm4#PyPI/lfx-docling
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-j8f7-x8jm-wmm4
• https://github.com/langflow-ai/langflow/pull/13016
• https://github.com/langflow-ai/langflow/pull/13395
• https://github.com/langflow-ai/langflow/pull/13643
• https://github.com/langflow-ai/langflow/pull/14033
• https://github.com/langflow-ai/langflow/pull/14071
• https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639
• https://github.com/langflow-ai/langflow
• https://github.com/langflow-ai/langflow/releases/tag/v1.10.3

published 2026-10-06T13:39:57Z · modified 2026-10-06T13:45:06.468251407Z · JSON