# CVE-2026-12822: langflow-ai Langflow code injection in Bundle URL Loader

Source: https://junglewise.ai/threats/cve-2026-12822-langflow-ai-langflow-code-injection-in-bundle-url-loader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-12822 · Severity: medium · CVSS 5.3 · Published 2026-06-22

Langflow, a visual framework for building multi-agent AI applications, contains a vulnerability in how it handles external component bundles. An attacker can provide a malicious URL that, when loaded, executes arbitrary code on the system hosting the application. This could lead to a complete system takeover, unauthorized access to sensitive AI models, or theft of proprietary data.

Technologies: [Langflow](https://junglewise.ai/threats/technologies/langflow). Vendors: [Langflow](https://junglewise.ai/threats/vendors/langflow).

## Quick answers

**Is CVE-2026-12822 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12822 being exploited in the wild.

**How severe is CVE-2026-12822?** Medium severity, with a CVSS score of 5.3, published 22 June 2026.

**Which products and versions are affected?** Langflow up to 1.9.3.

**Is there a fix for CVE-2026-12822?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12822 attacked?** It is attacked with local access or over the network, in a network appliance.

**Am I affected by CVE-2026-12822?** Check whether you run Langflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A code injection vulnerability exists in Langflow's Bundle URL Loader component (up to version 1.9.3). The application allows loading custom components from remote bundle URLs; however, it fails to implement a trust boundary or signature verification for the Python code contained within these bundles. When a bundle is processed, Langflow imports and executes the Python module-level code during the discovery phase. While some reports categorize this as a local attack (CVSS:3.1/AV:L), the underlying mechanism involves fetching remote archives, suggesting that any user with the privilege to configure bundle URLs can achieve Remote Code Execution (RCE). No official patch has been confirmed by the vendor at the time of disclosure.

## Affected products

- langflow-ai langflow up to 1.9.3

## Timeline

- 2026-06-22: advisory: NVD publication date
- 2026-06-22: disclosed: Public disclosure via VulDB and GitHub research repository

## References

- [https://github.com/dxz0069/softwareoverflow/blob/main/langflow_bundle_url_custom_component_startup_rce_vulndb.md](https://github.com/dxz0069/softwareoverflow/blob/main/langflow_bundle_url_custom_component_startup_rce_vulndb.md)
- [https://vuldb.com/cve/CVE-2026-12822](https://vuldb.com/cve/CVE-2026-12822)
- [https://vuldb.com/submit/837582](https://vuldb.com/submit/837582)
- [https://vuldb.com/vuln/372612](https://vuldb.com/vuln/372612)
- [https://vuldb.com/vuln/372612/cti](https://vuldb.com/vuln/372612/cti)

## Related threats

- [Langflow SSRF in URL-taking components](https://junglewise.ai/threats/langflow-ssrf-in-url-taking-components-protection-disabled-by-default-db7cac37)
- [Langflow authorization bypass in flow API endpoints](https://junglewise.ai/threats/cve-2026-105698-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow MCP stdio command injection](https://junglewise.ai/threats/cve-2026-105697-langflow-is-a-tool-for-building-and-deploying-ai-powered-agents)
- [Langflow unsafe eval() in schema.py code execution](https://junglewise.ai/threats/cve-2026-101861-langflow-1-0-16-before-1-12-0-and-0-0-94-before-1-12-0-contain)
- [IBM Langflow OSS path traversal arbitrary file write](https://junglewise.ai/threats/cve-2026-84889-ibm-langflow-oss-path-traversal-arbitrary-file-write)