Description
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, any authenticated Langflow user can achieve Remote Code Execution (RCE) on the server by adding an MCP server with the "Stdio" transport. The user-supplied command field is passed directly to bash -c "exec {command}" with zero validation, no allowlisting, and no sandboxing. The command executes immediately when the server list is fetched. Additionally, the env field allows arbitrary environment variable injection (e.g., LD_PRELOAD, PATH override). This vulnerability is fixed in 1.9.0.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected products
- langflow-ai / langflow< 1.9.0 – < 1.9.0
News coverage
- Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsThe Hacker News · 12d ago
References
- VENDOR_ADVISORYhttps://github.com/langflow-ai/langflow/security/advisories/GHSA-7w94-79vh-5mr2
- VENDOR_ADVISORYhttps://github.com/langflow-ai/langflow/security/advisories/GHSA-w794-rj3p-xv45
- PATCHhttps://github.com/langflow-ai/langflow/pull/12290
- PATCHhttps://github.com/langflow-ai/langflow/commit/efbc4a16e639409d938a4883463d27ef0bc637a0
Updated 20m ago · 8 sources