CVE-2026-0769criticalexplotación observadaCWE-95

CVE-2026-0769: fallo crítico en Langflow

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Langflow

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

77Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 9.8epss 41%
de la publicación al armael mismo día
Publicada en NVD23 ene
metasploit22 ene
VulnCheck+152d
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Langflow · Langflow
CVEs relacionadas — Langflow

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-34291CRITICALLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCEEPSS 93.2%KEVCVE-2026-0770CRITICALLangflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityEPSS 62.6%KEVCVE-2026-0768CRITICALLangflow code Code Injection Remote Code Execution VulnerabilityEPSS 28.1%CVE-2026-0772HIGHLangflow Disk Cache Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.2%CVE-2026-0771HIGHLangflow PythonFunction Code Injection Remote Code Execution VulnerabilityEPSS 0.6%