IBM Langflow Desktop Stored Cross-Site Scripting Vulnerability
Vulnerability
A stored cross-site scripting vulnerability has been identified in IBM Langflow Desktop versions 1.6.0 through 1.8.4. This vulnerability allows authenticated users to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.
Impact
Exploitation of this vulnerability could result in session theft, account takeover, and further exploitation depending on user privileges.
Remediation
Users are advised to upgrade to IBM Langflow Desktop version 1.9.0 or newer. Instructions for downloading Langflow Desktop are available on the Langflow website.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.