CVE-2026-7873: Langflow: Code Injection Vulnerability in Code Validation Endpoint

validate_code in src/lfx/src/lfx/custom/validate.py compiled each submitted function and then ran exec() on it. That executes decorators and default-argument expressions, so code runs during validation, even though the function is never called. A default argument that writes a file or starts a process is enough.

The attacker needs a Langflow account that can reach the endpoint. The fix pull request notes that with the default AUTO_LOGIN setup the flaw is effectively open to anyone who can reach the server. They get OS command execution as the Langflow process and can read sensitive files, including credentials. The CVSS scope is changed, since Langflow servers typically hold API keys for model providers and databases. IBM's bulletin describes this as enabling complete system compromise and lateral movement.

The patch makes validate_code compile only, and never exec() it. The create_function, execute_function and eval_function paths are unchanged and are gated by allow_custom_components. A reviewer noted that the import loop still calls importlib.import_module on top-level imports, deferred to a follow-up.

Affected: pip langflow from 1.0.0 up to but not including 1.10.1.rc0, per IBM Langflow OSS 1.0.0 through 1.10.0, on Windows, Linux and macOS.

pip show langflow

If you run the Docker image, check the image tag. Servers that are reachable from a network, or that use the default AUTO_LOGIN, have the highest exposure.

Upgrade to Langflow 1.10.1. The package data lists the patched version as 1.10.1.rc0.

pip install --upgrade langflow

IBM lists no workarounds. Until you upgrade, restrict network access to the Langflow server and turn off AUTO_LOGIN so that only known users can reach the endpoint. After upgrading, rotate credentials stored on the host if you cannot rule out misuse.

Look in the Langflow access logs for requests to the code validation endpoint from accounts or addresses you do not expect, particularly with function definitions that contain default arguments calling os, subprocess or open. On the host, look for child processes of the Langflow process and for new files in temporary directories. Check outbound connections from the server. Beam records agent shell commands and file access, which helps if an AI agent drives the flow editor.

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.