Langflow
CVE-2026-0769
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to eval_custom_component_code endpoint
-
ExploitInject malicious Python code in user-supplied string parameter
-
ImpactExecute arbitrary Python code in Langflow process context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default Langflow installations with eval_custom_component_code function accessible. Requires network access to the vulnerable endpoint. |
| Impact | CVSS 9.8, EPSS 2.0%. Second Langflow code execution vulnerability. eval-based code processing is fundamentally unsafe for user-provided input. |
| Exploit ScenarioDerived | An attacker crafts a custom component definition containing malicious Python code that Langflow evaluates, gaining full server access including LLM API keys and connected database credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted custom component definitions.
Earlier versions of this analysis (1)
Eval injection in Langflow custom components enables arbitrary Python execution.
RemediationAI
Update Langflow. Replace eval with AST-based parsing or sandboxed execution.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The eval_custom_component_code function in Langflow uses Python's eval (CWE-95) to process custom component code, allowing injection of arbitrary Python expressions.
Know when Langflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
Executive ViewAI
A critical remote code execution vulnerability (CVE-2026-0769) in Langflow allows unauthenticated attackers to execute arbitrary code with a 9.8 CVSS severity rating. Any organization running Langflow is at immediate risk of full system compromise, data theft, and operational disruption. This requires urgent action as no patch is currently available.
Disable eval_custom_component_code feature if not critical to operations; restrict network access to Langflow via firewall/VPC isolation; implement Web Application Firewall (WAF) rules to detect and block eval injection patterns; run Langflow in containerized environments with minimal system privileges and read-only filesystems where possible; enable comprehensive logging and alerting on code execution attempts; consider air-gapping or decommissioning affected instances until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
OS command injection in Langflow's MCP stdio transport allows an attacker who can reach the MCP server configuration end
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
GitHub PoC
Exploit-DB