Executive brief
IBM Langflow is an open-source AI workflow automation platform used to build and run AI applications. An authenticated attacker can execute arbitrary Python code on the server due to an unguarded eval() function processing attacker-supplied input, allowing complete compromise of the Langflow server and any data it has access to.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the lfx CodeParser component, which passes return-type annotation source directly to eval() without sanitization. An authenticated attacker can craft malicious input containing arbitrary Python code that gets evaluated server-side with the privileges of the application process. This bypasses code-execution restrictions and allows direct execution of arbitrary Python code. The attack requires authentication and network access to the Langflow server. IBM has published security advisories identifying multiple related code-execution vulnerabilities in Langflow 1.0.0 through 1.11.5.
Affected products
- IBM Langflow 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed