The flaw is a code injection vulnerability in Langflow (langflow-ai/langflow, up to v1.9.3), located in the code validation endpoint in src/backend/base/langflow/api/v1/validate.py. Raw Python source submitted to the /api/v1/validate/code route is passed to a server-side compile/exec path without sandboxing, letting an attacker run arbitrary code on the server remotely over the network, with the requirement that they be able to authenticate to the service.
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.
First seen exploited 5 days after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: langflow.
Upgrade to 1.10.3 or later
Fixes this CVE and 7 other known vulnerabilities in this package (CVE-2026-0770, CVE-2026-105697, +5).
pip install "langflow>=1.10.3"First fixed in 1.10.1 for CVE-2026-51886.
| If you run | Upgrade to |
|---|---|
| 1.7.2 up to 1.10.1 | 1.10.3first fix for this CVE: 1.10.1 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.