# CVE-2026-101861: Langflow unsafe eval() in schema.py code execution

Source: https://junglewise.ai/threats/cve-2026-101861-langflow-1-0-16-before-1-12-0-and-0-0-94-before-1-12-0-contain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-101861 · Severity: medium · CVSS 4.1 · Published 2026-09-28

Langflow is a platform for building AI applications with components and flows. An unsafe eval() vulnerability in schema.py allows authenticated attackers to execute arbitrary Python code when converting components into LangChain tools, including when saving custom components. However, exploiting this requires the attacker to already have component authoring privileges, which grants equivalent code execution capabilities directly.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow), [Langflow-Base](https://junglewise.ai/threats/technologies/langflow-langflow-base), [Langflow Lfx](https://junglewise.ai/threats/technologies/lfx). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow).

## Quick answers

**Is CVE-2026-101861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101861 being exploited in the wild.

**How severe is CVE-2026-101861?** Medium severity, with a CVSS score of 4.1, published 28 September 2026.

**Which products and versions are affected?** Langflow 1.0.16 to 1.11.6; Langflow-Base 0.0.94 to 1.11.6; Langflow Lfx before 1.12.0.

**Is there a fix for CVE-2026-101861?** A patch was published on 2026-09-28: Fix released in versions langflow 1.12.0, langflow-base 1.12.0, lfx 1.12.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101861 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-101861?** Check whether you run Langflow, Langflow-Base or Langflow Lfx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in create_input_schema() and create_input_schema_from_dict() functions in schema.py, which build typing.Literal types by interpolating component options into a string passed directly to eval(). The sink is triggered via ComponentToolkit.get_tools() when components are converted to tools, including during custom component saves (POST /api/v1/custom_component) and tool-mode component builds. Exploitation requires embedding a Python object with a malicious __repr__ method in component options; in practice this requires component authoring capability, which already permits arbitrary code execution. The vulnerability was fixed in version 1.12.0 by replacing eval() with safe literal construction.

## Affected products

- Langflow langflow 1.0.16 to 1.11.6
- Langflow langflow-base 0.0.94 to 1.11.6
- Langflow lfx before 1.12.0

## Timeline

- 2026-09-28: disclosed: GHSA-33p4-w7j3-33mw published
- 2026-09-28: patched: Fix released in versions langflow 1.12.0, langflow-base 1.12.0, lfx 1.12.0

## References

- [https://github.com/langflow-ai/langflow/releases](https://github.com/langflow-ai/langflow/releases)
- [https://github.com/langflow-ai/langflow/security/advisories/GHSA-33p4-w7j3-33mw](https://github.com/langflow-ai/langflow/security/advisories/GHSA-33p4-w7j3-33mw)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [IBM Langflow OSS path traversal arbitrary file write](https://junglewise.ai/threats/cve-2026-84889-ibm-langflow-oss-path-traversal-arbitrary-file-write)
- [IBM Langflow OSS privilege escalation in MCP Tools component](https://junglewise.ai/threats/cve-2026-81941-ibm-langflow-oss-privilege-escalation-in-mcp-tools-component)