Langflow Security Vulnerabilities Expose AI Systems

Langflow (pip) contains three critical vulnerabilities—an IDOR allowing authenticated access to other users' flows, a TAR extraction flaw enabling arbitrary file reads and potential remote code execution, and an unauthenticated file upload that can exhaust disk space and leak file paths. The flaws carry a top severity of 9.9; patches are available (upgrade to 1.9.1/1.9.2) and no in-the-wild exploitation has been confirmed.