PyPI/langflow CVE-2026-55447: critical 9.6, EPSS 0.66%

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

Action: Upgrade langflow to 1.9.2 or later.

pip install langflow==1.9.2

Affected

Fixed versions

Sources

• osv: PYSEC-2026-378
• https://github.com/langflow-ai/langflow/security/advisories/GHSA-ccv6-r384-xp75
• https://github.com/langflow-ai/langflow/pull/12945
• https://github.com/langflow-ai/langflow
• https://pypi.org/project/langflow
• https://github.com/advisories/GHSA-ccv6-r384-xp75
• https://nvd.nist.gov/vuln/detail/CVE-2026-55447

CVE-2026-55447 · published 2026-06-29T11:50:52.436774Z · modified 2026-07-01T20:22:55.869683Z · JSON