Remote code execution in Langflow code validation API (CVE-2026-8481)

CVE-2026-8481 is a critical remote code execution vulnerability in the Langflow OSS code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions. Any authenticated user can exploit this to execute arbitrary system commands with the full privileges of the Langflow server process. Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 9.9 · our assessment: act_now Vendor advisory: https://www.ibm.com/support/pages/node/7278923 Details: https://vuln.today/cve/CVE-2026-8481