Verified

ghsa:GHSA-HHXR-7J22-694R: langflow >= 1.3.0, < 1.10.3

Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution. Affected range: >= 1.3.0, < 1.10.3.

Affected technology

langflow · >= 1.3.0, < 1.10.3
Vendor not specified by the source

Component: LambdaFilterComponent
Function: eval
File: src/lfx/src/lfx/components/llm_operations/lambda_filter.p

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

Published 12-Oct-2026 10:15 UTC

Product: langflow
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-hhxr-7j22-694r.html