Skip to content
OpenAdvisories
Medium WID-SEC-2026-1337 2 CVEs

Langflow: Mehrere Schwachstellen ermöglichen Codeausführung

Published May 3, 2026 · Updated May 3, 2026 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um beliebigen Programmcode auszuführen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 2

  • Medium 6.3
    CVE-2026-7687

    langflow-ai langflow Full Builtins code_parser.py CodeParser.parse_callable_details command injection

    A vulnerability was determined in langflow-ai langflow up to 1.8.4. Affected by this issue is the function CodeParser.parse_callable_details of the file src/lfx/src/lfx/custom/code_parser/code_parser.py of the component Full Builtins Module Handler. Executing…

    langflow-ai langflow
  • Medium 6.3
    CVE-2026-7700

    langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection

    A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.py of the component LambdaFilterComponent. Executing a manipulation can lead to code inject…

    langflow-ai langflow langflow PyPI

Revision history

  1. #1

    Initiale Fassung

References