AIKIDO-2026-139156
langflow is vulnerable to Code Injection
88
High Risk
This Affects:
langflowTL;DR
Langflow's Smart Transform component (LambdaFilterComponent) builds a prompt that asks an LLM to generate a one-line Python lambda from flow-author instructions and a preview of the input data. The returned lambda passes only superficial syntactic checks and is then evaluated with Python's full builtins and invoked inside the Langflow process. A flow author can place a payload directly in the Instructions field, and when an exposed flow routes untrusted content into the component the injected instruction can also reach the model, so crafted input executes arbitrary Python with the privileges of the Langflow service process. The fix validates the generated code's abstract syntax tree and evaluates it with a restricted builtins mapping.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run flows that use the Smart Transform (Lambda Filter) component with author-controlled or externally influenced instructions or input data.
Background info
langflow is vulnerable to Code Injection in versions 1.3.0 - 1.10.2.
How to fix this
Upgrade the langflow library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant