CVE-2026-7873 · GHSA-v798-mcc6-2m3m
Langflow: Code Injection Vulnerability in Code Validation Endpoint
- Risk score
- 64/100
- CVSS
- 9.9 v3.1
- Published
- 30 Jun 2026
Open in the live forecast Today's forecast
What to know
- What it is
- IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
- Affected
- langflow (pip) >= 1.0.0, < 1.10.1.rc0
- Fix
- Upgrade langflow to 1.10.1.rc0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
langflow: Red, act today. Langflow's built-in Python interpreter components — PythonREPLComponent (Python Interpreter) and the legacy PythonREPLToolComponent (Python REPL Tool) — executed arbitrary user- or model-supplied Python code inside flows without effective sandboxing. Because the code ran in-process with the privileges of the Langflow …
The flaws
- CVE-2026-7873: Langflow: Code Injection Vulnerability in Code Validation Endpoint (CVSS 9.9)
- CVE-2026-10561: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation (CVSS 9.9 · EPSS 1%)
- CVE-2026-51886: Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description (CVSS 9.8 · EPSS 0%)
- CVE-2026-105697: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration (CVSS 9.9 · EPSS 0%)
The fix
Upgrade langflow: 1.10.1 · 1.10.3 or later on your release line
Who is exposed: langflow (pip) < 1.10.1
Where it stands
- No known exploitation
Connects to
- Same weakness: Code injection (CWE-94). 237 other warnings in 30 days
Why it is Amber
- CVSS 9.9 critical
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| langflow | pip | >= 1.0.0, < 1.10.1.rc0 | 1.10.1.rc0 |
References
- https://github.com/advisories/GHSA-v798-mcc6-2m3m
- https://nvd.nist.gov/vuln/detail/CVE-2026-7873
- https://www.ibm.com/support/pages/node/7278441
- https://github.com/langflow-ai/langflow/pull/13696
- https://github.com/langflow-ai/langflow/commit/e7c33dbaade20b5295c7fa26bf83cc1ff68fba02
- https://github.com/langflow-ai/langflow/releases/tag/1.10.1.rc0
- https://github.com/advisories/GHSA-v798-mcc6-2m3m
Original description
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.
Last activity 30 Jun 2026. Patch Forecast updates every hour.