Vbcrlf

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.9.2 **Description** An issue exists in components based on `BaseFileComponent`, including Docling (`DoclingInlineComponent`), Docling Serve (`DoclingRemoteComponent`), Read File (`FileComponent`), NVIDIA Retriever Extraction (`NvidiaIngestComponent`), Video File (`VideoFileComponent`), and Unstructured API (`UnstructuredComponent`). The ` unpack bundle()` function in `langflow/src/lfx/src/lfx/base/data/base file.py` fails to properly validate files during TAR extraction, allowing the processing of symlinks. An attacker can provide a crafted TAR file containing symlinks to absolute paths on the file-system, directing the node to read arbitrary files. This can lead to the exposure of sensitive information, such as the `secret key` used for JWT tokens, which could subsequently allow an attacker to bypass authentication and achieve remote code execution by creating a flow with a Python Interpreter node. **Recommendations** Update to version 1.9.2 or later. As a temporary workaround, restrict the use of components based on `BaseFileComponent` when processing user-controlled data.

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.9.1 **Description** Unauthenticated users with network access can upload unlimited amounts of data to the server, which can lead to disk space exhaustion and a resulting denial-of-service. Additionally, the server response discloses the absolute path of the uploaded file, creating an information leak that could be used to facilitate further attacks. This issue occurs at the '/api/v1/upload/{flow id}' endpoint via the `create upload file()` function, where there is a lack of authentication and validation for the `flow id` variable. Over 38,300 potentially affected instances were identified via FOFA. **Recommendations** Update to version 1.9.1. As a temporary workaround, restrict network access to the '/api/v1/upload/{flow id}' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.10.0 **Description** The Shareable Playground feature, also known as Public Flows, allows unauthenticated users to execute workflows via a public link. A flaw in this feature enables arbitrary file reading depending on the flow configuration. Specifically, the endpoint '/api/v1/build public tmp' accepts a `files` parameter containing a list of file paths. These paths can be local files or S3 paths, which are then read by the `to lc message` function within `LCModelComponent. get chat result` and fed into the Large Language Model (LLM) as images. The ability to retrieve the file contents depends on the specific LLM configuration used. **Recommendations** Update to version 1.10.0. As a temporary workaround, disable the Shareable Playground feature to prevent unauthenticated users from executing public flows.

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.9.2 **Description** The Shareable Playground (also known as Public Flows) feature allows unauthenticated users to execute workflows via a link. A flaw in the '/api/v1/build public tmp' endpoint enables attackers to execute arbitrary Python code on the server by submitting a crafted JSON payload. The issue occurs because the system allows providing custom Python code within the `data.nodes[X].data.node.template.code.value` variable during flow execution. Over 30,900 potentially affected deployments were identified via FOFA. This can lead to full system compromise, data theft, or service disruption. **Recommendations** Update to version 1.9.2. As a temporary workaround, disable the Shareable Playground feature to prevent unauthenticated access to the vulnerable endpoint.