CVE-2026-0768
Langflow code Code Injection Remote Code Execution Vulnerability
Description
Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code parameter provided to the validate endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute Python code. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-27322.
Severity
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitation Context
as of October 23, 2026- Its current EPSS score (22.9%) is higher than that of 37% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Langflow | Langflow Langflow | 1.4.2 |
References
1 LinksRecord Details
More from Langflow
Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.