PT-2026-36703 · Langflow · Langflow

Wenject · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7700

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions langflow versions prior to 1.8.5

Description A weakness in the LambdaFilterComponent allows for remote code injection. This issue occurs within the eval() function located in the file src/lfx/src/lfx/components/llm operations/lambda filter.p.

Recommendations Update to a version later than 1.8.4. As a temporary workaround, restrict the use of the eval() function within the LambdaFilterComponent.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

CVE-2026-7700

Affected Products

Langflow

References · 7

• 🔥 https://yuque.com/mengnanbulalei/ognlsk/hte2a98ro5gf8tp9?singleDoc#%20%E3%80%8AFirst%20release%20of%20Langflow%201.8.3%20Smart%20Transform%20eval()/Lambda%20injection%20RCE%20vulnerability%20analysis+POC%E3%80%8B · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7700 · Security Note
• https://vuldb.com/submit/804305 · Note
• https://vuldb.com/vuln/360869 · Note
• https://t.me/CVEtracker/52579 · Telegram Post
• https://t.me/cveNotify/161935 · Telegram Post
• https://vuldb.com/vuln/360869/cti · Note