PT-2026-1999 · Langflow+1 · Langflow

Gothburz + 1 · Published 2026-01-09 · Updated 2026-02-18 · CVE-2026-0769

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Langflow (affected versions not specified)

Description A flaw exists in Langflow that allows remote attackers to execute arbitrary code. This does not require authentication. The issue is due to insufficient validation of user-supplied input before it is used in the eval custom component code() function to execute Python code. An attacker can exploit this to execute code within the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

CVE-2026-0769

ZDI-26-035

Affected Products

Langflow

References · 6

• https://osv.dev/vulnerability/CVE-2026-0769 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-26-035 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0769 · Security Note
• https://twitter.com/CveFindCom/status/2014558781158392208 · Twitter Post
• https://twitter.com/CVEnew/status/2014576952842322103 · Twitter Post
• https://t.me/cveNotify/152369 · Telegram Post