CVE-2026-0771: (0Day) Langflow PythonFunction Code Injection Remote Code Execution Vulnerability
Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product.
The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0771?
CVE-2026-0771 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-0771?
To fix CVE-2026-0771, update Langflow to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-0771?
CVE-2026-0771 is a PythonFunction code injection vulnerability that enables remote code execution.
Who is affected by CVE-2026-0771?
CVE-2026-0771 affects installations of Langflow that utilize PythonFunction.
Can CVE-2026-0771 be exploited remotely?
Yes, CVE-2026-0771 can be exploited remotely, allowing attackers to execute arbitrary code.