gist.github.com /Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a

Type: Code Injection Product: langflow Affected versions: ≤1.9.3 Affected component: src/backend/base/langflow/api/v1/validate.py:post_validate_code Suggested CWE: CWE-94 (Code Injection) Reference: langflow-ai/langflow#13336

A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

Reproduction Notes (condensed, sanitized)

Condensed from the authorized local validation used for the original report; local filesystem paths are replaced with .

EXPECTED SUCCESSFUL RESULT:

The marker file /tmp/poc_marker.txt is created on the server

The file contains the expected content "RCE confirmed"

This confirms arbitrary Python code execution ROOT CAUSE:

The /api/v1/validate/code endpoint accepts user-supplied Python code

The code is passed to validate_code() function which uses compile() and exec()

No sandboxing, input validation, or security controls are applied

Any authenticated user can execute arbitrary Python code on the server SECURITY IMPACT:

Remote Code Execution with backend process privileges

Ability to read/write arbitrary files

Access to environment variables and secrets

Potential for lateral movement and persistence