langflow CVE-2026-12822

Local system access is required - network-based exploitation is explicitly ruled out by AV:L in the CVSS 4.0 vector. The attacker must hold at least low-privilege local credentials (PR:L), meaning the vulnerability is not exploitable by unauthenticated or external parties without first achieving local access. The attack specifically targets the Bundle URL Loader component, meaning that component must be in use or accessible to the attacker, which is a feature-specific rather than default-configuration condition. No user interaction is required once the attacker can submit a bundle URL. Limiting factors include the local-only vector, the low-privilege access prerequisite, and the scope being contained to the langflow process with no lateral movement to subsequent systems (SC:N/SI:N/SA:N). The exact process privileges under which langflow runs (user-level vs. service account) will determine the practical severity of the resulting code execution.

The CVSS 4.0 score of 1.9 places this in the lowest risk tier, driven by a local-only attack vector (AV:L) and low privilege requirement (PR:L), which severely constrains the attack surface to users with existing local system access. However, the PoC reference title explicitly labels this as RCE, which would normally imply higher impact than the VC:L/VI:L/VA:L ratings assigned - this conflict between the RCE label and low impact metrics should be independently verified against vendor guidance or the PoC itself. The CVSS 4.0 supplemental metric E:P confirms a proof-of-concept exploit exists publicly, elevating real-world exploitability above theoretical. There is no CISA KEV listing, indicating no confirmed active exploitation at time of analysis. EPSS data was not provided in the input, so exploitation probability cannot be quantified. No scope change to subsequent systems is indicated (SC:N/SI:N/SA:N), suggesting the blast radius is contained to the langflow process context. Overall, this is a low-priority issue for organizations not exposing langflow to untrusted local users, but the public PoC and absent vendor patch make it worth tracking.

A low-privilege local user on a system running langflow 1.9.x submits a crafted bundle URL to the Bundle URL Loader component; during component startup or initialization, insufficient input validation causes the injected payload within the bundle to be parsed and executed in the langflow process context. A proof-of-concept demonstrating this technique is publicly available at https://github.com/dxz0069/softwareoverflow/blob/main/langflow_bundle_url_custom_component_startup_rce_vulndb.md, reducing the skill barrier for exploitation.