How severe is GHSA-9whx-c884-c68q?

GHSA-9whx-c884-c68q has a CVSS score of 9.6/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-9whx-c884-c68q?

GHSA-9whx-c884-c68q affects the following packages: langflow (PyPI). Ecosystems affected: PyPI.

How do I fix GHSA-9whx-c884-c68q?

Update langflow to 1.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9whx-c884-c68q is resolved across your whole dependency graph.

How do I detect GHSA-9whx-c884-c68q in my PyPI dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langflow. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-9whx-c884-c68q if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-9whx-c884-c68q?

O3 pinpoints whether GHSA-9whx-c884-c68q is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-9whx-c884-c68q actively exploited in the wild?

No public exploit code has been indexed for GHSA-9whx-c884-c68q yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-9whx-c884-c68q published, and has it been updated?

GHSA-9whx-c884-c68q was published on May 5, 2026 and was last updated on June 29, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐍

🐍 PyPI

Not in CISA KEV

CRITICAL severity

GHSA-9whx-c884-c68q

CRITICAL

GHSA-9whx-c884-c68q is a critical-severity (CVSS 9.6) vulnerability in langflow. O3 Security confirms whether GHSA-9whx-c884-c68q is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Langflow Knowledge Bases API is Vulnerable to Path Traversal

Also known asCVE-2026-42048PYSEC-2026-377

Published

May 5, 2026

Updated

Jun 29, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Jun 29, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

🐍langflow

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Langflow is vulnerable to Path Traversal in the Knowledge Bases API (DELETE /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit this flaw to delete arbitrary directories anywhere on the server's filesystem, leading to data loss and potential service disruption.

Details

The vulnerability exists in the delete_knowledge_bases_bulk function within src/backend/base/langflow/api/v1/knowledge_bases.py.

This function constructs file paths directly from the user-supplied kb_names parameter. While other knowledge base endpoints safely route through standard path resolution (e.g., _resolve_kb_path()), the bulk delete handler bypasses this entirely. It builds the path manually and passes it directly to shutil.rmtree() without validating if the resulting path resolves outside the intended user directory.

PoC (Proof of Concept)

For the Bulk Delete endpoint, an authenticated attacker can supply a traversal sequence in the kb_names parameter: ../victim_user/kb_name

Because the path is passed directly to shutil.rmtree() without containment checks, this payload deletes directories outside the intended scope.

Impact

Any Langflow instance exposing this endpoint to authenticated users is vulnerable. This exposes the server to:

Cross-user data compromise: Deletion of directories within another tenant's knowledge base space.
Arbitrary filesystem manipulation: Directory deletion at any path on the server where the application has write permissions.
Service disruption & Data Loss: Deletion of critical application files or unrecoverable data loss if backups are co-located on the same filesystem.

Fixes

The issue was addressed in PR #12243, which applies Path.resolve() to normalize the supplied path and validates that it starts with the authenticated user's directory before deletion. Subsequent updates (backported from PR #12337) introduced robust containment checks using Path.is_relative_to() to prevent prefix-ambiguity bugs.

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability:

@ddlxstudio
@nekros1xx

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
🐍PyPI	`langflow`	all versions	1.9.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for langflow. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update langflow to 1.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-9whx-c884-c68q is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-9whx-c884-c68q is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-9whx-c884-c68q. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary Langflow is vulnerable to Path Traversal in the Knowledge Bases API (`DELETE /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are concatenated directly into file paths without proper sanitization or boundary validation. An authenticated attacker can exploit this flaw to delete arbitrary directories anywhere on the server's filesystem, leading to data loss and potential service disruption. ## Details The vulnerability exists in the `delete_knowledge_bases_bulk` function within `src/backend/base/langflow/api/v1/knowledge_bases.py`. This function con

O3 Security · Impact-Aware SCA

Is GHSA-9whx-c884-c68q in your dependencies?

O3 detects GHSA-9whx-c884-c68q across PyPI dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works