Remote Code Execution Vulnerability in Langflow by Langflow
CVE-2026-0769

9.8CRITICAL

Key Information:

Vendor

Langflow

Status
Langflow
Vendor
CVE Published:
23 January 2026

What is CVE-2026-0769?

The eval_custom_component_code function in Langflow is vulnerable to an eval injection, allowing unauthenticated remote attackers to execute arbitrary code. By exploiting this flaw, which stems from inadequate validation of user-supplied strings, an attacker can run Python code in the context of the current process. This security issue poses significant risks to the integrity of applications utilizing Langflow.

Affected Version(s)

Langflow 1.3.2

References

https://www.zerodayinitiative.com/advisories/ZDI-26-035/
x_research-advisory

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.