Code Injection Vulnerability in Langflow by ZenML
CVE-2026-0771

7.1HIGH

Key Information:

Vendor

Langflow

Status
Langflow
Vendor
CVE Published:
23 January 2026

What is CVE-2026-0771?

The vulnerability arises from improper handling of Python function components in Langflow, allowing remote attackers to inject arbitrary Python code into workflows. Depending on the product's configuration, this may lead to unauthorized code execution within the application context. This poses a significant security risk as it enables attackers to manipulate workflows and execute code without proper authorization.

Affected Version(s)

Langflow 1.4.2

References

https://www.zerodayinitiative.com/advisories/ZDI-26-037/
x_research-advisory

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.