Executive brief
Langflow, a tool for building AI-powered applications, contains a vulnerability in its Agentic Assistant feature. This feature is intended to help users generate and validate code for AI components; however, it incorrectly executes the generated code on the server during the validation step. An attacker with access to this feature can provide inputs that cause the server to run malicious Python code, potentially leading to a full takeover of the server, data theft, or service disruption.
Technical details
A remote code execution vulnerability exists in Langflow's Agentic Assistant feature due to the unsafe handling of LLM-generated code. When a user interacts with the `/assist` endpoint, the application extracts component code from the model's response and passes it to a validation routine. This routine invokes `create_class()` within `lfx.custom.validate`, which uses the Python `exec()` function to dynamically instantiate the generated class. Because the validation phase is not sandboxed and treats model output as trusted executable code, an authenticated attacker can influence the LLM to produce malicious Python payloads that execute in the context of the Langflow server process. This vulnerability is patched in version 1.9.0.
Affected products
- langflow-ai langflow <= 1.8.1
Timeline
- 2026-03-24: advisory: Original GitHub Advisory published
- 2026-03-26: disclosed
- 1.9.0: patched