CVE-2026-12822Disclosure(langflow / langflow)

LOWCVSS 7.8 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.

langflow CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Vendor / third-party advisories

Other references

https://vuldb.com/vuln/372612/cti

Weakness type (CWE)

CWE-74CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

langflow

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Affected systems

Vendors

langflow

Products

langflow

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-12822 A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to cod… https://www.cve.org/CVERecord?id=CVE-2026-12822 ----- Traducción: CVE-2026-12822 Se … http://infoflow.cloud`
Post summary
A new CVE (CVE-2026-12822) affecting langflow-ai's langflow up to 1.9.3 is announced, highlighting an issue with the Bundle URL Loader component, but no further technical details, PoC, or patches are provided.
0000049
88 followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-12822 A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to cod… https://www.cve.org/CVERecord?id=CVE-2026-12822
Post summary
The post announces a new vulnerability (CVE‑2026‑12822) affecting the Bundle URL Loader component of langflow‑ai langflow up to v1.9.3, noting that manipulation of an unknown function can lead to code execution.
00000850
57.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
Disclosure
CVE-2026-12822 Code Injection in Langflow-AI Langflow Up to 1.9.3 Bundle URL Loader https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-12822
Post summary
CVE-2026-12822 exposes a code injection flaw in Langflow-AI versions up to 1.9.3, with no current reports of PoC, exploitation, or mitigation steps.
00000124
4.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	langflow	langflow	-	-	-

Explore more

Back to dashboard langflow CVEs langflow vulnerabilities