CVE-2026-51886: Code Injection
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-postvalidatecode-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need?
An attacker must be authenticated and able to send an HTTP POST request to the /api/v1/validate/code endpoint. They can submit malicious Python source through that endpoint.
Which deployments are most exposed?
Deployments that expose the HTTP or browser-backed service path and permit authenticated users to reach /api/v1/validate/code are affected. The route is described as accepting raw Python source without a visible entitlement guard.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary Python code on the server. The supplied code is forwarded to a server-side compile/exec validation path without sandboxing or security controls.