CVE-2026-51886Critical· 9.8▾ AbyssalPoC availablelangflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 8.8
none → high
Last analysed / modified upstream
Exploit / PoC code exists
8.8 → 9.8
high → critical
0.2% → 0.6%
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
langflow >= 1.7.2, < 1.10.1Patched in:
langflow 1.10.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7873Critical· 9.9Langflow: Code Injection Vulnerability in Code Validation Endpoint
CVE-2026-10561Critical· 9.9Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
CVE-2026-105698Medium· 5.4Langflow is a tool for building and deploying AI-powered agents and workflows
CVE-2026-27966Critical· 9.8Langflow has Remote Code Execution in CSV Agent
CVE-2026-7700Medium· 6.3A weakness has been identified in langflow-ai langflow up to 1.10.2
CVE-2026-105741High· 7.1Langflow is a tool for building and deploying AI-powered agents and workflows