CVE-2026-0771

HIGH

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-0771 has a selected CVSS score of 7.1 (high); EIP currently links 1 curated repository PoC.

Description

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product. The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 24, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Langflow

Browse Langflow / Langflow

Default status: unknown

CVE List1.4.2affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-0768Curated repository PoCby exploitintel8Exploit12 files

C · 406.4 KiB · linked to 6 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains three Python scripts (poc.py, poc_vector2.py, poc_vector3.py) that send crafted HTTP POST requests to the /api/v1/validate/code endpoint of a Langflow instance to achieve unauthenticated remote code execution. The scripts construct Python code payloads that exploit the use of exec() on user-supplied input, executing arbitrary OS commands and exfiltrating the output via the API response.

Backdoor review

No backdoor observed in reviewed code

All six supplied text files are documentation, lab reports, and three PoC scripts that demonstrate the claimed CVE-2026-0768 remote code execution vulnerability against a Langflow target. The PoC scripts send crafted HTTP requests to a locally controlled vulnerable instance; they contain no concealed backdoor, persistence mechanism, credential theft, unrelated payload, or operator-directed harm. The behavior is consistent with normal exploit demonstration.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareLangflow
Attack typesCode InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact consists of three Python scripts (poc.py, poc_vector2.py, poc_vector3.py) that are designed to send exploit payloads to a vulnerable endpoint to achieve remote code execution. The scripts construct malicious code, send it to the target, and parse the response to display the output of executed commands. This is the definition of exploit code.

poc/poc.py:1-287poc/poc_vector2.py:1-155poc/poc_vector3.py:1-198

Requirements

  • Network access to a vulnerable Langflow instance (version <= 1.4.2) on the target host and port.poc/poc.py:117-118
  • The target Langflow instance must have the /api/v1/validate/code endpoint exposed without authentication (default in v1.1.1).README.md:18

Observed behavior

  • Sends an HTTP POST request to /api/v1/validate/code with a JSON body containing a 'code' field.poc/poc.py:117-126
  • The 'code' field contains a Python function definition with a malicious default argument that executes an OS command via subprocess.check_output() and raises an exception to exfiltrate the output.poc/poc.py:96-101
  • Parses the HTTP response to extract the command output from the 'function.errors' field.poc/poc.py:145-173
  • Prints the extracted command output to the console, confirming successful remote code execution.poc/poc.py:207-217
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Target
Payload withheldThe PoC targets the documented vulnerable endpoint to achieve RCE, consistent with the CVE description.poc/poc.py:45poc/poc_vector2.py:41poc/poc_vector3.py:54
Exploit Technique
Payload withheldThe primary PoC embeds a command in a function default argument, which Python evaluates at definition time when exec() is called by the vulnerable endpoint.poc/poc.py:96-100
Exploit Technique
Payload withheldVector 2 uses subprocess.run() and a generator .throw() to exfiltrate command output via an exception.poc/poc_vector2.py:71-77
Exploit Technique
Payload withheldVector 3 uses a decorator expression that is evaluated at definition time, demonstrating an alternative code path.poc/poc_vector3.py:84-89
Review boundaries

What the analysis did not establish

  • The evidence packet contains complete text for the selected files, but the analysis scope indicates 'complete_artifact_coverage: false' and one non-text media file (interface-screenshot.png) was not analyzed. This does not affect the classification of the provided text-based PoC scripts.
  • Five unclassified binary/non-text files totaling 33,262 bytes were present in the artifact but were not analyzed; their content is unknown.
  • One non-text media file (330,810 bytes) was flagged as metadata-only and not inspected.
  • The review covers only the six selected text files; any backdoor present solely in the uninspected binary or media files would not be detected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2