Most recent entries from all

EUVD-2026-329680

fkie_cve-2026-10561

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

GHSA-8qpj-27x8-pwpq — Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation

Affected: PyPI: langflow

### Summary

Langflow's built-in Python interpreter components — `PythonREPLComponent` (Python Interpreter) and the legacy `PythonREPLToolComponent` (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow service, any **authenticated** user who could edit and run a flow could achieve remote code execution and, from there, escalate privileges to superuser (e.g. by opening a database session and flipping `is_superuser`) or compromise the host.

**This issue is fixed as of 1.10.1**, with additional hardening through 1.12.3. See *Remediation* below.

### Affected

- **Package:** `langflow` (PyPI), and the underlying `lfx` package that ships the component. - **Vulnerable versions:** `< 1.10.1`. - **Patched:** `1.10.1` (core fix). Upgrade to `>= 1.12.3` for the complete hardening series.

### Details

The root cause is **code injection** (CWE-94/CWE-95): the component passed raw input to LangChain's `PythonREPL`, which is explicitly *not* a security sandbox.

Two distinct weaknesses existed before 1.10.1:

1. **Unrestricted builtins (default deployments).** `get_globals()` built the `exec` globals from the `global_imports` allow-list but never set `__builtins__`. CPython's `exec()` then auto-injected the full `builtins` module, leaving `__import__`, `open`, `eval`, `exec` and the whole import machinery reachable regardless of the allow-list — e.g. `__i…