Langflow CVE-2026-101861

Requires an authenticated account on the Langflow instance with the ability to create or save custom components through the API. The attacker must supply a Python object with a crafted __repr__ method into a component input options list, and code execution fires only when that component is converted into a LangChain tool via ComponentToolkit.get_tools() (including on custom-component save). Limiting factors: authentication is mandatory (PR:H per vendor), attack complexity is high (AC:H) and a specific attack requirement applies (AT:P) due to the object-crafting and interpolation path; there is no unauthenticated or default-configuration exposure. Note that in Langflow the privilege needed to reach this sink often already permits legitimate Python execution via custom components, narrowing the practical additional risk.

This is a code-injection flaw (CWE-95) via an unsafe eval() sink in Langflow's schema.py, but real-world risk is bounded by steep exploitation prerequisites and a design context that makes marginal impact small. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L, score 2.1) signals network reach but with high attack complexity, a specific attack requirement, and high privileges - an authenticated actor who can already save custom components. This is significant because Langflow custom components execute Python by design, so an attacker at that privilege level already has legitimate code-execution paths; the eval() bug adds an alternative sink rather than a new privilege boundary crossing, which explains the vendor's low VC/VI/VA:L ratings despite the 'RCE' tag. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or opportunistic exploitation. My independent view is that the technical impact of eval()-based execution is higher than L (I assess C/I/A:H), but the authentication and complexity gates keep this a low-to-moderate operational priority rather than an urgent patch. Note a tension worth verifying with the vendor: the description says 'authenticated attackers' and the vector uses PR:H, yet saving custom components is a common authenticated-user capability, so PR:L may be more accurate for many deployments.

An authenticated Langflow user crafts a custom component whose input options list contains a Python object with a malicious __repr__ method, then saves it through the API. When the component is converted into a LangChain tool via ComponentToolkit.get_tools(), the option is interpolated into a Literal type string and passed to eval(), executing the attacker's payload on the server. No public exploit code was identified at time of analysis.