Langflow CVE-2026-7700

Authentication is required: the attacker must possess valid Langflow login credentials (PR:L). The attacker must have access to the LambdaFilterComponent in Langflow's pipeline builder or configuration interface. The lambda filter expression input field must not validate or sanitize Python code before passing it to the eval() function. Default Langflow installations with the LambdaFilterComponent enabled and network-accessible are vulnerable; air-gapped or restricted deployments with disabled lambda filters are not affected. The vulnerability does not require user interaction beyond the attacker's own actions (UI:N).

CVSS 6.3 with AV:N/AC:L/PR:L indicates remote network-accessible exploitation requiring valid user credentials but low attack complexity. EPSS is not provided, limiting probabilistic exploitation assessment. The public availability of exploit code significantly increases practical risk despite the CVSS score being in the medium range. The KEV (Known Exploited Vulnerability) status is not confirmed in provided data, but public exploit availability combined with active vulnerability disclosure indicates real-world exploitation potential. The PR:L (low privilege) requirement means legitimate Langflow users, external collaborators, or compromised low-privilege accounts can exploit this. Attack complexity is low (AC:L), suggesting no special exploitation techniques are required beyond crafting malicious lambda filter expressions. The confidentiality, integrity, and availability impacts are all rated as low (C:L/I:L/A:L), but code injection in Python typically enables privilege escalation and full system compromise depending on Langflow's runtime environment and permissions. The unpatched status and vendor non-responsiveness elevate practical risk significantly.

An authenticated Langflow user with access to pipeline configuration navigates to the Lambda Filter component and enters a malicious Python expression such as '__import__("os").system("id")' in the filter field. When the filter is executed or evaluated, the injected code runs within the Langflow process's context, allowing the attacker to read files, execute system commands, or pivot to other systems depending on Langflow's runtime permissions. Publicly available exploit code reduces the barrier for non-expert attackers.