Description

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-04T15:17:49.930Z",
  "pubdate": "2026-09-04T15:17:49.930Z",
  "executiveSummary": "IBM Langflow OSS versions 1.0.0 through 1.11.2 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability residing within the Playground chat interface.\nThis security flaw allows an authenticated or unauthenticated attacker to inject malicious scripts into the application, which are subsequently stored and executed within the context of other users' sessions.\nThe vulnerability poses significant risk to the integrity and confidentiality of the user environment, as successful exploitation enables the execution of arbitrary JavaScript in the victim's browser.\nPotential impacts include the theft of sensitive session tokens, unauthorized performace of actions on behalf of the victim, and potential account takeover scenarios.\nBecause the payload is persistent, the vulnerability affects any user who interacts with the compromised chat history, facilitating wide-scale exploitation across the user base.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) flaw located in the Playground chat interface of IBM Langflow OSS versions 1.0.0 through 1.11.2.\nThe root cause of this vulnerability lies in the improper sanitization or encoding of user-supplied input before it is rendered within the chat interface's Document Object Model (DOM).\nIn the context of the Langflow Playground, the application accepts chat inputs and stores them for historical reference. If the application fails to validate or escape these inputs, an attacker can supply a crafted payload containing malicious HTML or JavaScript tags, such as <script>alert(document.cookie)</script> or event handlers like onerror within an <img> tag.\nThe attack flow proceeds as follows: First, an attacker interacts with the Playground chat interface and injects a malicious payload into the input field. The backend stores this malicious string directly into the database without adequate filtration. Subsequently, when an unsuspecting victim navigates to the Playground or views the chat history, the application retrieves the stored data and injects it into the victim's browser session. Because the content is served as trusted data, the victim's browser executes the script in the context of the origin, effectively bypassing the same-origin policy restrictions.\nThe technical implication is the execution of arbitrary code within the victim's session. This allows for the exfiltration of session cookies, CSRF tokens, or other sensitive local storage data. Furthermore, the attacker can manipulate the DOM to perform unauthorized API requests or modify the visual representation of the chat history to deceive other users.\nGiven that the application stores this data persistently, every user accessing the affected chat session is exposed to the malicious payload, making this a high-impact, wormable vulnerability depending on the accessibility of the chat interface within the organization. The vulnerability does not appear to require specific elevated privileges, as the entry point is the public-facing chat interface."
}