PT-2026-1999 · Langflow+1 · Langflow

Gothburz + 1 · Publicado 2026-01-09 · Atualizado 2026-02-18 · CVE-2026-0769

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Langflow (affected versions not specified)

Description A flaw exists in Langflow that allows remote attackers to execute arbitrary code. This does not require authentication. The issue is due to insufficient validation of user-supplied input before it is used in the eval custom component code() function to execute Python code. An attacker can exploit this to execute code within the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Eval Injection

Enumeração de Fraquezas

CWE-95

Identificadores relacionados

CVE-2026-0769

ZDI-26-035

Produtos afetados

Langflow

Referências · 6

• https://osv.dev/vulnerability/CVE-2026-0769 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2014558781158392208 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2014576952842322103 · Publicação no Twitter
• https://zerodayinitiative.com/advisories/ZDI-26-035 · Nota de Segurança
• https://t.me/cveNotify/152369 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-0769 · Nota de Segurança