Langflow EUVD-2026-91120

Exploitation requires reaching the public-facing HTTP route POST /api/v1/validate/code on a Langflow server (up to and including v1.9.3) and submitting raw Python source, which is forwarded into a server-side compile/exec validation path with no sandboxing or entitlement guard. The description states the attacker is authenticated, so a valid Langflow account/session is the primary prerequisite and limiting factor - contradicting the input vector's PR:N; no user interaction, non-default configuration, or specific platform is otherwise required. Realistic risk is highest for internet-exposed instances, multi-tenant/shared deployments, or installations with disabled or weak authentication.

Signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 Critical, implying unauthenticated network RCE, but the description explicitly states 'An authenticated attacker can execute arbitrary Python code' - these conflict: the vector encodes PR:N while the narrative requires authentication, so the true base score is likely closer to ~9.0-9.1 with PR:L. Verify authentication requirement with the vendor/advisory before treating this as unauthenticated. Technical impact is total (C:H/I:H/A:H) - direct server-side arbitrary Python execution via /api/v1/validate/code with no sandboxing. Counterweight signals lower the urgency: EPSS is only 0.17% (6th percentile), there is NO CISA KEV listing (not confirmed actively exploited), yet publicly available exploit code exists (a GitHub gist PoC and issue). Net: this is a genuine high-priority RCE for any internet-exposed Langflow instance, but the low EPSS and absence of KEV suggest it is not yet under widespread automated exploitation; the authentication requirement (if real) further constrains it to attackers who already hold valid credentials, meaning the realistic risk is high for exposed/shared instances but not indiscriminate mass exploitation.

An attacker with valid Langflow credentials (or on an instance where authentication is weak, shared, or disabled) sends an HTTP POST to /api/v1/validate/code containing malicious Python source. The endpoint compiles and executes the supplied code server-side without sandboxing, yielding arbitrary code execution in the Langflow process context. A public PoC gist and GitHub issue demonstrating the flaw already exist, lowering the skill barrier; the low attack complexity (AC:L) means no special timing or race conditions are required.