CVE-2026-8447: Langflow Stored XSS Vulnerability

CVE-2026-8447 Overview

CVE-2026-8447 is a stored cross-site scripting (XSS) vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.11.2. The flaw resides in the Playground chat interface, where user-supplied content is rendered without sufficient output encoding. An authenticated attacker can persist malicious script payloads that execute in the browsers of other users who view the affected chat session. The weakness is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation). Successful exploitation can lead to session compromise, credential theft, and unauthorized actions within the Langflow interface.

Critical Impact
Stored XSS in the Langflow Playground allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking and data exfiltration from the AI workflow environment.

Affected Products

IBM Langflow OSS 1.0.0 through 1.11.2
Deployments on Apple macOS, Linux, and Microsoft Windows
Any Langflow instance exposing the Playground chat interface to multiple users

Discovery Timeline

2026-09-04 - CVE-2026-8447 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-8447

Vulnerability Analysis

Langflow is an open-source framework for building agentic and retrieval-augmented generation (RAG) applications. The Playground chat interface allows users to interact with configured flows in real time. The interface renders chat messages, including responses from language models and user inputs, back into the browser DOM. Because message content is not properly neutralized before rendering, HTML and JavaScript payloads stored in a chat session execute when a user loads the Playground view. The vulnerability requires user interaction, since a victim must open the affected chat, and the scope is changed, meaning executed script can access resources beyond the vulnerable component.

Root Cause

The root cause is improper neutralization of input during web page generation (CWE-79). Message content persisted through the Playground is inserted into the rendered page without contextual output encoding or a strict HTML sanitization step. Any script tags, event handler attributes, or JavaScript URIs supplied through chat input survive storage and are interpreted by the browser on retrieval.

Attack Vector

An attacker with access to a Langflow flow or chat session submits a payload containing HTML or JavaScript through the Playground chat input. The payload is stored server-side alongside legitimate chat history. When another authenticated user opens the same Playground session, the browser parses and executes the malicious script in the context of the Langflow origin. The attacker can then read authentication tokens from browser storage, issue authenticated API calls, modify flows, or exfiltrate data processed by the AI workflow.

See the IBM Support advisory for vendor-provided technical details.

Detection Methods for CVE-2026-8447

Indicators of Compromise

Chat messages or flow session records containing <script>, onerror=, onload=, or javascript: sequences
Outbound HTTP requests from user browsers to unfamiliar domains immediately after Playground use
Unexpected authenticated API calls to Langflow endpoints originating from legitimate user sessions

Detection Strategies

Inspect Langflow message stores and flow session databases for HTML tags, event handlers, and encoded script payloads
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution attempts in the Playground
Correlate browser telemetry with Langflow server access logs to identify anomalous DOM activity following chat rendering

Monitoring Recommendations

Enable audit logging on Langflow API endpoints handling chat message creation and retrieval
Alert on chat payloads exceeding expected length or containing HTML control characters
Monitor for privilege changes, flow modifications, or credential rotations initiated from active Playground sessions

How to Mitigate CVE-2026-8447

Immediate Actions Required

Upgrade Langflow OSS to a version later than 1.11.2 that includes the vendor fix
Restrict Playground access to trusted users and disable public exposure of the Langflow web interface
Rotate authentication tokens and API keys for users who accessed the Playground during the exposure window
Review stored chat histories and remove any messages containing embedded HTML or script content

Patch Information

Refer to the IBM Support advisory for node 7285646 for the fixed release version and upgrade guidance. Apply the patched release across all Langflow deployments running versions 1.0.0 through 1.11.2.

Workarounds

Place Langflow behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts and untrusted origins
Disable or restrict the Playground feature for shared environments until the patched version is deployed
Require authentication and role-based access control on all Langflow endpoints to limit which users can submit chat content

bash

# Example Content Security Policy header enforced at the reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";