Langflow <=1.8.3 Stored XSS via Markdown Renderer (rehype-raw)

Vulnerability Overview Vulnerability ID: #791923 Vulnerability Name: Langflow <= 1.8.3 Stored Cross-Site Scripting (XSS) Vulnerability Vulnerability Type: Stored Cross-Site Scripting Affected Component: Markdown renderer in Langflow frontend component Vulnerability Description: - The frontend component of Langflow relies on a Markdown component to render chat messages and flow descriptions. - The Markdown renderer explicitly enables raw HTML parsing using the plugin but fails to pair it with a sanitization plugin such as . - This oversight allows arbitrary HTML and JavaScript injection into the DOM, affecting any user who views the content. - Vulnerable code file: - Frontend React component rendering function: The JSX block processes user input. - By enabling without using , dangerous tags and attributes (e.g., or ) are retained and executed in the browser. - An attacker can log into Langflow GUI 2, use the chat interface to send messages, or update the project’s Flow Description. - The attacker injects an XSS payload, for example: . - Backend security policy allows this payload to be stored in the database without sanitization (this is expected behavior). - When the attacker or other victims (such as higher-privileged administrators) view the chat history or project configuration, the victim’s browser renders the malicious Markdown and executes the embedded JavaScript payload. Impact Scope Impact: - Session Hijacking: JavaScript execution allows the attacker to steal the value stored in . - Account Takeover and Privilege Escalation: Scripts can perform unauthorized asynchronous HTTP API calls on behalf of an administrator, deleting databases or modifying security settings. Persistence Risk: Payloads are stored in the database, affecting every user who accesses the contaminated project or chat session. Affected Versions: Langflow <= 1.8.3 Remediation Remediation Recommendations: - Pair the plugin with the plugin in the Markdown renderer configuration. - Ensure proper security configuration of the Markdown renderer to prevent arbitrary HTML and JavaScript injection. - Backend security policies should implement sanitization mechanisms to prevent malicious payloads from being stored in the database. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Langflow <=1.8.3 Stored XSS via Markdown Renderer (rehype-raw)