CVE-2026-51886: Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

validate_code() in src/lfx/src/lfx/custom/validate.py parses the submitted code with ast. For every FunctionDef node it calls compile() and then exec() to surface errors. The author assumed that defining a function does not run its body. That is true, but Python evaluates decorators the moment the def statement runs. A payload such as @lambda x: (__import__('os').system('touch /tmp/pwned'), x)[1] above a stub function executes at once.

The attacker needs a valid token or API key, or no login at all when AUTO_LOGIN is on. They POST the JSON code field to /api/v1/validate/code. Commands run with the privileges of the Langflow process, so the attacker can read environment variables (provider API keys, database credentials), modify files and pivot into the internal network. Before 1.7.2 the endpoint had no authentication at all, so the same sink was reachable anonymously. A duplicate report triggered the same exec() through default-argument evaluation instead of a decorator.

langflow >= 1.7.2, < 1.10.1. In this range the endpoint needs a session, but any user qualifies, including everyone when AUTO_LOGIN is enabled. Releases before 1.7.2 had the same exec() sink with no authentication, so they are worse, even though the package data starts at 1.7.2.

pip show langflow

Upgrade to langflow 1.10.1:

pip install -U langflow==1.10.1

PR #13696 changed validate_code() so it no longer calls exec() on FunctionDef nodes. It only compile()s them to report syntax errors, which never evaluates decorators or default-argument expressions. This closes both the decorator and the default-argument variants. The advisory lists no workaround. Until you upgrade, limit who can log in, turn off AUTO_LOGIN and keep the instance off untrusted networks.

Search reverse proxy or application logs for POST requests to /api/v1/validate/code, especially from accounts or IPs that do not normally edit components, and for request bodies containing __import__, os.system or a leading @ decorator. On the host, look for child processes of the Langflow service and files such as /tmp/pwned from the proof of concept. Check for unexpected outbound connections and for use of API keys held in the Langflow environment.

###Summary: A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.

Details

The vulnerability is located in src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py).

The validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:

# src/lfx/src/lfx/custom/validate.py
if isinstance(node, ast.FunctionDef):
    code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec")
    # ...
    # exec_globals creates a restricted-looking scope, but standard builtins are available
    exec(code_obj, exec_globals)

By design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the "validation" phase.

Affected Versions

• `/api/v1/validate/code` had no authentication at all until commit 3fed9fe1b5 ("fix: Add authentication to various endpoints", #10977), first released in v1.7.2. Before that release, this same exec() sink was reachable unauthenticated.
• From v1.7.2 through v1.10.0, the endpoint required a valid session but the exec() sink was untouched, so any authenticated user (or any user at all under AUTO_LOGIN) could trigger RCE via a malicious decorator as described below.
• Fixed in v1.10.1 — see Fix section.

PoC

• Authenticate as any user (acquire a valid access token or API key).
• Send a POST request to /api/v1/validate/code with the following JSON payload:

{
  "code": "@lambda x: (__import__('os').system('touch /tmp/pwned'), x)[1]\ndef pwned():\n    pass"
}

Curl Example

curl -X POST "http://<TARGET_HOST>/api/v1/validate/code" \
     -H "Authorization: Bearer <YOUR_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{"code": "@lambda x: (__import__(\"os\").system(\"echo RCE_SUCCESS > /tmp/pwned\"), x)[1]\ndef pwned():\n    pass"}'

Verify: Check the server file system. The file /tmp/pwned will be created.

Impact

This vulnerability results in Remote Code Execution (RCE).

Impacted Parties: Any user with access to the Langflow instance (Authenticated Users). Consequence: An attacker can execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.

Fix

Fixed in v1.10.1 by PR #13696 (commit e7c33dbaad, tracked as GHSA-2wcq-pvw2-xh7v): validate_code() in src/lfx/src/lfx/custom/validate.py no longer exec()s submitted FunctionDef nodes. It now only compile()s them to surface syntax/compile errors, which never evaluates decorators or default-argument expressions, closing this sink entirely.

This same fix independently resolves the different exploitation technique reported in duplicate advisory GHSA-xjq8-cqrm-7m4x (RCE via default-argument evaluation instead of a decorator). Both advisories share the exact same root-cause sink — the unconditional exec() in validate_code() — and differ only in which Python construct (decorator vs. default argument) is used to trigger execution at definition time. Credit for this finding is accordingly shared with the reporter of that duplicate.