CVE-2026-0771highCWE-94

CVE-2026-0771: fallo de gravedad alta en Langflow

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Langflow

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.6%
Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Langflow · Langflow
CVEs relacionadas — Langflow

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-34291CRITICALLangflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCEEPSS 93.2%KEVCVE-2026-0770CRITICALLangflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution VulnerabilityEPSS 62.6%KEVCVE-2026-0769CRITICALLangflow eval_custom_component_code Eval Injection Remote Code Execution VulnerabilityEPSS 41.2%CVE-2026-0768CRITICALLangflow code Code Injection Remote Code Execution VulnerabilityEPSS 28.1%CVE-2026-0772HIGHLangflow Disk Cache Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 1.2%