CVE-2026-0770

HIGH

Langflow affected by Remote Code Execution via validate_code() exec()

Published January 23, 2026Updated July 7, 2026Source: osv

Summary

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the exec_globals parameter provided to the validate endpoint. The issue results from the inclusion of a resource from an untrusted control sphere. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27325.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
langflow	pypi	0.0.31, 0.0.32, 0.0.33, 0.0.40 (+276 more)	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-829
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

References

Frequently Asked Questions

What is CVE-2026-0770?: Langflow affected by Remote Code Execution via validate_code() exec() This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-0770?: CVE-2026-0770 affects langflow. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-0770 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-g22f-v6f7-2hrh

PYSEC-2026-1525

Related CVEs

CVE-2026-27966
CRITICAL
Langflow has Remote Code Execution in CSV Agent
CVE-2026-42048
CRITICAL
Langflow Knowledge Bases API is Vulnerable to Path Traversal
CVE-2026-55447
CRITICAL
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
CVE-2026-33309
CRITICAL
Langflow has an Arbitrary File Write (RCE) via v2 API
CVE-2026-48519
CRITICAL
Langflow: Unauthenticated RCE in Shareable Playgrounds
CVE-2024-42835
HIGH
langflow has vulnerability in PythonCodeTool component
CVE-2026-21445
HIGH
Langflow Missing Authentication on Critical API Endpoints
CVE-2024-48061
MEDIUM
Langflow vulnerable to remote code execution

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies