Executive brief
Langflow, a visual framework for building multi-agent AI applications, contains a vulnerability in how it handles external component bundles. An attacker can provide a malicious URL that, when loaded, executes arbitrary code on the system hosting the application. This could lead to a complete system takeover, unauthorized access to sensitive AI models, or theft of proprietary data.
Technical details
A code injection vulnerability exists in Langflow's Bundle URL Loader component (up to version 1.9.3). The application allows loading custom components from remote bundle URLs; however, it fails to implement a trust boundary or signature verification for the Python code contained within these bundles. When a bundle is processed, Langflow imports and executes the Python module-level code during the discovery phase. While some reports categorize this as a local attack (CVSS:3.1/AV:L), the underlying mechanism involves fetching remote archives, suggesting that any user with the privilege to configure bundle URLs can achieve Remote Code Execution (RCE). No official patch has been confirmed by the vendor at the time of disclosure.
Affected products
- langflow-ai langflow up to 1.9.3
Timeline
- 2026-06-22: advisory: NVD publication date
- 2026-06-22: disclosed: Public disclosure via VulDB and GitHub research repository