{"id":"CVE-2026-51886","published":"2026-10-01T22:17:03Z","modified":"2026-10-06T01:16:36Z","title":"langflow-ai langflow v1.9.3 is affected by: Code Injection","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a code injection vulnerability in Langflow (langflow-ai/langflow, up to v1.9.3), located in the code validation endpoint in src/backend/base/langflow/api/v1/validate.py. Raw Python source submitted to the /api/v1/validate/code route is passed to a server-side compile/exec path without sandboxing, letting an attacker run arbitrary code on the server remotely over the network, with the requirement that they be able to authenticate to the service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:19:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00602,"percentile":0.48762,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-06","exploitedFirstSeen":"2026-10-06","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-51886","date":"2026-10-06"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":4,"pulses":[{"name":"Known_Cve | Oct 10, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac903591ff588ac9423f235","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac7b19da11e545ded10ae9b","created":"2026-10-08"},{"name":"Known_Cve | Oct 8, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac65e541c36819c31053833","created":"2026-10-07"},{"name":"Known_Cve | Oct 7, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ac50f7dfc0547b9e8e2e5df","created":"2026-10-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a","tags":[]},{"url":"https://github.com/langflow-ai/langflow/issues/13336","tags":[]},{"url":"https://github.com/langflow-ai/langflow/issues/13336","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"langflow","vulnerableRanges":[">=1.7.2, <1.10.1"],"patched":["1.10.1"],"from":["GHSA-w584-2h2r-2hvf","PYSEC-2026-4236"],"provenance":"source"}],"advisories":[{"id":"GHSA-w584-2h2r-2hvf","url":"https://github.com/advisories/GHSA-w584-2h2r-2hvf","severity":"HIGH","ecosystem":"PyPI","package":"langflow","vulnerableRanges":[">=1.7.2, <1.10.1"],"patched":["1.10.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-91120","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91120","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51886","provenance":"source"},{"date":"2026-10-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-51886","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":63.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 25 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.75,"detail":"percentile 0.4876"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}