IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.12.4. https://pypi.org/project/langflow/1.12.4/
For Langflow OSS versions 1.0.0 - 1.12.3, follow the Prepare to upgrade instructions and release-specific configuration changes https://docs.langflow.org/release-notes , including backing up your existing installation, then follow the Langflow OSS installation instructions https://docs.langflow.org/get-started-installation to install version 1.12.4 and test your flows.