https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 07:09:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278684 EUVD-2026-278684 https://cve.radiocsirt.org/vuln/euvd-2026-278684 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33873 <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33873 https://cve.radiocsirt.org/vuln/ghsa-v8hw-mh8c-jxfc <p><strong>Affected:</strong> PyPI: langflow</p> <p>## Description</p> <p>### 1. Summary</p> <p>The Agentic Assistant feature in Langflow executes LLM-generated Python code during its **validation** phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side.</p> <p>In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution.</p> <p>### 2. Description</p> <p>#### 2.1 Intended Functionality</p> <p>The Agentic Assistant endpoints are designed to help users generate and validate components for a flow. Users can submit requests to the assistant, which returns candidate component code for further processing.</p> <p>A reasonable security expectation is that validation should treat model output as **untrusted text** and perform only static or side-effect-free checks.</p> <p>The externally reachable endpoints are:</p> <p>[https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/router.py#L252-L297](https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/router.py#L252-L297)</p> <p>The request model accepts attacker-influenceable fields such as `input_value`, `flow_id`, `provider`, `model_name`, `session_id`, and `max_retries`:</p> <p>[https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow…</p> <p><strong>Affected:</strong> PyPI: langflow</p> <p>## Description</p> <p>### 1. Summary</p> <p>The Agentic Assistant feature in Langflow executes LLM-generated Python code during its **validation** phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side.</p> <p>In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution.</p> <p>### 2. Description</p> <p>#### 2.1 Intended Functionality</p> <p>The Agentic Assistant endpoints are designed to help users generate and validate components for a flow. Users can submit requests to the assistant, which returns candidate component code for further processing.</p> <p>A reasonable security expectation is that validation should treat model output as **untrusted text** and perform only static or side-effect-free checks.</p> <p>The externally reachable endpoints are:</p> <p>[https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/router.py#L252-L297](https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow/agentic/api/router.py#L252-L297)</p> <p>The request model accepts attacker-influenceable fields such as `input_value`, `flow_id`, `provider`, `model_name`, `session_id`, and `max_retries`:</p> <p>[https://github.com/langflow-ai/langflow/blob/f7f4d1e70ba5eecd18162ec96f3571c2cfbcd1fc/src/backend/base/langflow…</p> https://cve.radiocsirt.org/vuln/ghsa-v8hw-mh8c-jxfc https://cve.radiocsirt.org/vuln/pysec-2026-82 <p><strong>Affected:</strong> PyPI: langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.</p> <p><strong>Affected:</strong> PyPI: langflow</p> <p>Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the implementation reaches dynamic execution sinks and instantiates the generated class server-side. In deployments where an attacker can access the Agentic Assistant feature and influence the model output, this can result in arbitrary server-side Python execution. Version 1.9.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/pysec-2026-82 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0841 <p>Ein Angreifer kann eine Schwachstelle in Langflow ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann eine Schwachstelle in Langflow ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0841