Verified

ghsa:GHSA-QQW9-2VJ9-HX7R: langflow >= 1.7.2, < 1.10.1

Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description. Affected range: >= 1.7.2, < 1.10.1.

Affected technology

langflow · >= 1.7.2, < 1.10.1
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

Published 12-Oct-2026 10:15 UTC

Product: langflow
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-05 23:10:51.172112+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-qqw9-2vj9-hx7r.html