Langflow: Code injection in /api/v1/validate/code allows remote code execution
Summary
Langflow's code validation endpoint /api/v1/validate/code executes user-supplied Python code through exec(). A restriction meant to limit this to function definitions does not cover decorators, which are evaluated at definition time. Any authenticated user who can reach the endpoint can run arbitrary code with the privileges of the Langflow backend process, including reading and writing files and accessing environment variables and secrets.
Affected
- Langflow versions from 1.7.2 before 1.10.1 (GHSA range)
- The CVE record lists versions up to 1.9.3, but the GHSA range also includes 1.10.0. Treat all versions below 1.10.1 as vulnerable.
Fixed in
- Langflow 1.10.1 (fix commit e7c33dbaade20b5295c7fa26bf83cc1ff68fba02, pull request #13696)
Workaround
- No vendor workaround known.
- Restrict which accounts can log in and who holds them.
- Block external access to the /api/v1/validate/ path at the reverse proxy or firewall if it is not required.
- Run the Langflow service as a non-root, least-privilege user.
Exploitation
- CISA SSVC data lists exploitation as 'poc' (proof of concept), automatable: yes, technical impact: total.
- The reporter has published a public gist with the exploit steps.
- No confirmed in-the-wild exploitation found. The CVE is not in the CISA KEV catalog.
Our recommendation
- Inventory all Langflow instances, including Docker images, and record their versions.
- Upgrade to Langflow 1.10.1 or later.
- Until the upgrade is done, restrict logins, limit network access to the instance and check accounts.
- Review logs for unexpected requests to the validate endpoint.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV: GHSA-w584-2h2r-2hvf osv.dev
- GitLab Advisory Database: CVE-2026-51886 advisories.gitlab.com
- Langflow issue #13336 github.com
- Reporter gist: CVE-2026-51886 gist.github.com
- VulDB: CVE-2026-51886 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:32.
Original description (NVD)
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.