CVEvulnerability

CVE-2026-0771

7.1 HIGH Published 2026-01-23 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-01-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.

Affected configurations

• langflow langflow 1.4.2

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References