github.com /langflow-ai/langflow/issues/13336

A code injection vulnerability exists in Langflow's code validation endpoint ( /api/v1/validate/code ). The endpoint accepts arbitrary Python code from authenticated users and executes it server-side through exec() without proper sandboxing or security controls. This allows an authenticated attacker to execute arbitrary Python code on the server, leading to complete system compromise.

The vulnerable endpoint /api/v1/validate/code accepts a POST request with Python source code in the request body. The code is then passed to validate_code() function which compiles and executes it using Python's compile() and exec() functions without any security restrictions:

An authenticated attacker can submit malicious Python code that will be executed with the same privileges as the Langflow backend process, allowing:

Reading/writing arbitrary files on the server

Executing system commands

Accessing environment variables and secrets

Establishing reverse shells

Lateral movement within the network

Step 1: Set Up Langflow Instance

Step 2: Access Langflow UI

Open browser and navigate to

Create a new user account or log in with existing credentials

After successful login, you'll be redirected to the main dashboard

Step 3: Create a Flow with Custom Python Code

Click "New Flow" or open an existing flow

From the left sidebar, drag a "Custom Component" or "Python Function" node onto the canvas

Double-click the component to open its settings

Look for a "Code" field or "Edit Code" button - this opens the code editor modal

Step 4: Inject Malicious Code in the Code Editor

In the code editor that appears, replace the default code with the following exploit payload:

Alternative payload for more visible proof:

Step 5: Trigger the Validation

The vulnerability is triggered automatically when:

You click "Validate" or "Check Code" button in the code editor

You save the code (the UI automatically validates before saving)

The code editor performs auto-validation on blur or after typing

The malicious code will be sent to /api/v1/validate/code and executed server-side.

Step 6: Verify Code Execution

Check the parent directory of the Langflow installation:

Expected content in rce_proof.txt :

Step 7: Confirm Vulnerability

The successful creation of these files confirms:

The code validation endpoint executes user-supplied Python code

Any authenticated user can exploit this through the normal UI

No special tools (Burp, curl) are needed - just the browser

The code runs with backend process privileges

The /api/v1/validate/code endpoint should:

Never execute user-supplied code directly - Code validation should be performed through static analysis only (AST parsing, linting)

Implement proper sandboxing - If dynamic execution is absolutely necessary, use restricted execution environments like: Docker containers with limited capabilities Python's RestrictedPython library Separate sandboxed processes with resource limits

Docker containers with limited capabilities

Python's RestrictedPython library

Separate sandboxed processes with resource limits

Apply principle of least privilege - Validation should not require full code execution

Add authorization checks - Restrict this functionality to admin users only (if it must exist)

Input validation - Reject code containing dangerous imports or operations

@italojohnny @ogabrielluiz @nicoloboschi