EUVD-2026-38203
GHSA-fxq6-8jqq-rh9v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector, low-privilege access required, no scope change; impact rated Low across CIA consistent with provided CVSS 4.0 VC:L/VI:L/VA:L ratings.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Code injection in langflow's Bundle URL Loader component allows local attackers with low privileges to inject and execute arbitrary code within the langflow process across versions 1.9.0 through 1.9.3. A publicly available proof-of-concept demonstrating startup-time RCE via maliciously crafted bundle URLs has been published by the researcher, though the CVSS 4.0 vector (VC:L/VI:L/VA:L) rates impact as low - a discrepancy with the RCE claim in the PoC that warrants independent verification. No vendor-released patch is available; the vendor did not respond to the researcher's disclosure.
Technical ContextAI
Langflow is an open-source visual AI workflow builder that enables users to construct LLM-based pipelines via a drag-and-drop interface, including loading custom component bundles from remote URLs through the Bundle URL Loader feature. CWE-74 (Injection) identifies the root cause as insufficient neutralization of user-controlled input - in this case, a bundle URL or its fetched contents - before that input is interpreted or executed by the application, likely during component initialization or application startup. The reference PoC filename ('langflow_bundle_url_custom_component_startup_rce_vulndb.md') indicates the injection is triggered during the startup lifecycle of a custom component, suggesting that maliciously crafted bundle payloads are parsed and executed without adequate sandboxing or validation. Affected versions confirmed by EUVD-2026-38203 are 1.9.0, 1.9.1, 1.9.2, and 1.9.3. No CPE strings were provided in the input data.
RemediationAI
No vendor-released patch is available at time of analysis - the vendor did not respond to the researcher's coordinated disclosure. Organizations running langflow 1.9.0 through 1.9.3 should monitor the official langflow GitHub repository and VulDB advisory (https://vuldb.com/vuln/372612) for a patched release. As a compensating control, restrict access to the langflow interface exclusively to trusted local users, since exploitation requires local low-privilege access; this trade-off limits collaborative or multi-user deployments. If the Bundle URL Loader feature is not required for current workflows, disabling or blocking access to that component eliminates the attack surface, though this will prevent custom component bundles from being loaded via URL. Network-level isolation of the host running langflow reduces exposure further, noting that AV:L already limits the vector to local access only.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today