Akshatgit

An authenticated user can access credentials from another workspace by providing a credential UUID. This occurs because the system performs lookups using `findOneBy({ id: credentialId })` without verifying the `workspaceId` of the requesting user. This issue affects the following endpoints: - GET '/api/v1/openai-assistants' - GET '/api/v1/openai-assistants/:id' - POST '/api/v1/openai-assistants-file/upload/' - DELETE '/api/v1/assistants/:id' - GET '/api/v1/text-to-speech/voices' Exploitation allows an attacker to force the server to decrypt and utilize OpenAI or ElevenLabs API keys belonging to a different workspace.

Langflow uses a weak and reversible key derivation mechanism for encryption at rest, which could lead to the disclosure of all stored credentials.

The `/api/v1/monitor` router exposes seven endpoints that allow read, write, and delete operations on user-owned resources, including messages, sessions, build artifacts, and LLM transaction logs. The system fails to verify if the authenticated requester owns the targeted resource, leading to an Insecure Direct Object Reference (IDOR), also known as Broken Object Level Authorization (BOLA). An authenticated user can read, modify, rename, or permanently delete another user's data by providing the target's resource ID or `flow id`. Technical details include the following vulnerable endpoints: - 'GET /api/v1/monitor/builds' and 'DELETE /api/v1/monitor/builds' using the `flow id` variable. - 'DELETE /api/v1/monitor/messages' using the `message ids` variable. - 'PUT /api/v1/monitor/messages/{message id}' using the `message id` variable. - 'PATCH /api/v1/monitor/messages/session/{old session id}' using the `old session id` variable. - 'DELETE /api/v1/monitor/messages/session/{session id}' using the `session id` variable. - 'GET /api/v1/monitor/transactions' using the `flow id` variable.

When a `NodeVM` is created with the `nesting` variable set to `true`, sandbox code can unconditionally use `require('vm2')` regardless of the outer VM's `require` configuration, including when `require` is set to `false`. This occurs because the `nesting: true` option interacts with the legacy module resolver in a way that silently overrides restrictions. An attacker can use access to `vm2` to construct a new inner `NodeVM` with unrestricted `require` settings to execute arbitrary OS commands on the host. This issue affects applications running untrusted code inside a `NodeVM` with `nesting: true`, such as multi-tenant code execution platforms, notebook/REPL services, plugin systems, and CI sandboxing tools.

Open WebUI is a self-hosted artificial intelligence platform designed for offline operation. A flaw exists in the speech-to-text transcription endpoint where an unsanitized filename field allows any authenticated, non-admin user to trigger a `FileNotFoundError`. The error message, including the server's absolute `DATA DIR` path, is then returned in the HTTP 400 response body, leading to information disclosure on default deployments. The issue stems from a lack of path sanitization when extracting the file extension from the filename and constructing the file path. Specifically, the `file.filename.split(".")[-1]` function is used without any sanitization, and the resulting value is concatenated into a filesystem path. This allows an attacker to craft a filename containing directory traversal sequences (e.g., `audio./etc/passwd`) to reveal the server's absolute path. The vulnerability is present in the `backend/open webui/routers/audio.py` file, at line 1197, and is triggered when attempting to open a file with a malicious filename. The MIME-type guard does not prevent this issue.

Langflow versions 1.0.0 through 1.8.1 have an issue where the `/api/v1/files/images/{flow id}/{file name}` API endpoint serves image files without authentication or ownership verification. An unauthenticated request with a known `flow id` and `file name` will successfully retrieve the image, returning an HTTP 200 response. In a multi-tenant environment, an attacker who can discover or guess a `flow id` can download images uploaded by any user without authorization. The `flow id` is a UUID that may be exposed through other API responses. The vulnerable function is `download image` located in `src/backend/base/langflow/api/v1/files.py:138-164`.

Langflow, a tool for building and deploying AI-powered agents and workflows, contains a security flaw that allows authenticated attackers to write files anywhere on the host system, potentially leading to Remote Code Execution (RCE). The root architectural issue within `LocalStorageService` remains unresolved due to a lack of boundary containment checks in the underlying storage layer. The system relies entirely on the HTTP-layer `ValidatedFileName` dependency, which fails to protect against this issue. Specifically, the `POST /api/v2/files/` endpoint is vulnerable because the multipart upload filename bypasses the path-parameter guard. The vulnerability exists in two layers: the API layer (`src/backend/base/langflow/api/v2/files.py:162`) and the storage layer (`src/backend/base/langflow/services/storage/local.py:114-116`). The filename is extracted directly from the multipart `Content-Disposition` header and used in naive path concatenation without proper validation. A proof-of-concept demonstrates the ability to write a file outside the user's storage directory using directory traversal techniques. Successful exploitation could allow attackers to overwrite critical system files, inject malicious Python components, or compromise the system's security.