{"id":"CVE-2026-51886","published":"2026-10-01T00:00:00Z","modified":"2026-10-05T23:56:49Z","title":"langflow-ai langflow v1.9.3 is affected by: Code Injection","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.","provenance":"source","from":"CVE.org"},"summary":{"text":"Langflow (langflow-ai) through version 1.9.3 contains a code injection flaw in its validation API, specifically the POST handler for /api/v1/validate/code in src/backend/base/langflow/api/v1/validate.py, which accepts raw Python source and passes it to a server-side compile/exec path.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-11-01T01:04:27Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00602,"percentile":0.48803,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-06","exploitedFirstSeen":"2026-10-06","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-51886","date":"2026-10-06"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/langflow-ai/langflow/issues/13336","tags":[]},{"url":"https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"langflow","vulnerableRanges":[">=1.7.2, <1.10.1"],"patched":["1.10.1"],"from":["GHSA-w584-2h2r-2hvf","PYSEC-2026-4236"],"provenance":"source"}],"advisories":[{"id":"GHSA-w584-2h2r-2hvf","url":"https://github.com/advisories/GHSA-w584-2h2r-2hvf","severity":"HIGH","ecosystem":"PyPI","package":"langflow","vulnerableRanges":[">=1.7.2, <1.10.1"],"patched":["1.10.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-91120","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-91120","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-51886","provenance":"source"},{"date":"2026-10-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-51886","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":61.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 26 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.76,"detail":"percentile 0.4880"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}