6.4
Medium
CVE-2026-3346 IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting
Description
IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Langflow Desktop 1.6 | 1.6.0 → 1.8.4 | No fix stated |
Other CVEs of Langflow Desktop
The 8 CVEs of Langflow Desktop →
CVE-2026-3341
IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF)
5.4
Medium
CVE-2026-6543
IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges…
8.8
High
CVE-2026-3345
IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system
6.5
Medium
CVE-2026-3340
IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF)
6.5
Medium