Vulnerability PYSEC-2026-1525
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 months ago
July 07, 2026 at 04:03 PM UTC
Langflow affected by Remote Code Execution via validate_code() exec()
0.0.31 - 1.7.3
0.0.31 - 1.7.3
Summary
Langflow affected by Remote Code Execution via validate_code() exec()
Details
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 months ago
Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint
0.0.31 - 1.8.4 PYSEC-2026-2566
0.0.31 - 1.8.4 PYSEC-2026-2566
Low Risk
2 months ago
Langflow has an Information Leak through Incomplete API Key Redaction
0.0.31 - 1.8.3 PYSEC-2026-2565
0.0.31 - 1.8.3 PYSEC-2026-2565
Medium Risk
2 months ago
Langflow: Cleartext Storage of Authentication Settings in Project Creation Endpoint
0.0.31 - 1.9.0 PYSEC-2026-2568
0.0.31 - 1.9.0 PYSEC-2026-2568
Medium Risk
2 months ago
Langflow vulnerable to injection
0.0.31 - 1.8.3 PYSEC-2026-2569
0.0.31 - 1.8.3 PYSEC-2026-2569
Unknown
2 months ago
Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check
0.0.31 - 1.5.0.post2 PYSEC-2026-2567
0.0.31 - 1.5.0.post2 PYSEC-2026-2567
Impacted packages
Timeline
Published
2 months ago
July 07, 2026 at 04:03 PM UTC
Last Modified
2 months ago
July 07, 2026 at 05:46 PM UTC