Langflow Stored Cross-Site Scripting Vulnerability via Malicious SVG Upload

A stored cross-site scripting vulnerability has been identified in Langflow. The issue arises in the '/api/v1/files/images/{flow_id}/{file_name}' endpoint, which serves SVG files with the 'image/svg+xml' content type without proper content sanitization. This lack of sanitization allows attackers to upload malicious SVG files that execute arbitrary JavaScript when viewed by other users. Consequently, this vulnerability could be exploited to steal authentication tokens stored in cookies, including JWT access and refresh tokens.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded SVG files execute JavaScript in the context of the user viewing the file, potentially leading to the theft of authentication tokens from cookies.