{
  "repository": "github.com/langflow-ai/langflow",
  "commit_source": "git_rev_parse",
  "commit_sha": "f52d0f0072dcb6968f147ba3a90a3c1ece79995b",
  "submitted_target": {
    "target_kind": "commit",
    "commit_sha": "f52d0f0072dcb6968f147ba3a90a3c1ece79995b",
    "version": "langflow 1.9.0 / langflow-base 0.9.0",
    "ref": "f52d0f0072",
    "display": "langflow 1.9.0 (commit f52d0f0072) — vulnerable parent of the fix"
  },
  "variant_target": {
    "target_kind": "commit",
    "commit_sha": "f52d0f0072dcb6968f147ba3a90a3c1ece79995b",
    "version": "langflow 1.9.0 / langflow-base 0.9.0",
    "ref": "f52d0f0072",
    "display": "langflow 1.9.0 (commit f52d0f0072) — variant reproduced on vulnerable build"
  },
  "fixed_target_tested": {
    "target_kind": "commit",
    "commit_sha": "b0afe3d2d6506f3d69aff83325d46f0ec481e02a",
    "version": "langflow 1.9.0 + fix PR #12832 (LE-639)",
    "ref": "b0afe3d2d6",
    "display": "fix commit b0afe3d2d6 — same variant request blocked (HTTP 404 FLOW_NOT_FOUND)"
  },
  "latest_main_tested": {
    "target_kind": "commit",
    "commit_sha": "315cc41b43c446bfb0e63d420ca55021f6f8987e",
    "ref": "origin/main",
    "display": "current main 315cc41b43 — inspected read-only; authenticated HTTP surface uses auth-aware wrappers (get_flow_for_api_key_user / get_flow_for_current_user) and widen_for_shares; bare Depends(get_flow_by_id_or_endpoint_name) no longer used by any authenticated HTTP route. No bypass."
  },
  "resolution_method": "git -C <project-cache-repo> rev-parse <ref>; vulnerable + fixed stacks built editable from git archive of the respective commits; fixed phase swaps only helpers/flow.py on the same SQLite DB/users/flow.",
  "provenance": {
    "project_cache_repo": "/data/pruva/project-cache/688af86e-dc4c-4d20-bb02-ccdf8da2c7d0/repo",
    "venv": "/data/pruva/project-cache/688af86e-dc4c-4d20-bb02-ccdf8da2c7d0/venv-idor",
    "vulnerable_source": "/data/pruva/project-cache/688af86e-dc4c-4d20-bb02-ccdf8da2c7d0/lf-src-vuln (git archive f52d0f0072)"
  },
  "notes": "PyPI never published langflow 1.9.0/1.9.1/1.9.2 (the 1.x series starts at 1.9.3 which already contains the fix), so the vulnerable + fixed stacks were built from the repo source. The variant was reproduced on the vulnerable build (f52d0f0072) and confirmed BLOCKED on the fixed build (b0afe3d2d6) on the same DB/flow/users, swapping only helpers/flow.py between phases. This is an alternate trigger, not a bypass."
}