AIKIDO-2026-139156

langflow is vulnerable to Code Injection

CVE-2026-7700Published Aug 5, 2026

CVE Score

High

Code Injection

TL;DR

Langflow's Smart Transform component (LambdaFilterComponent) builds a prompt that asks an LLM to generate a one-line Python lambda from flow-author instructions and a preview of the input data. The returned lambda passes only superficial syntactic checks and is then evaluated with Python's full builtins and invoked inside the Langflow process. A flow author can place a payload directly in the Instructions field, and when an exposed flow routes untrusted content into the component the injected instruction can also reach the model, so crafted input executes arbitrary Python with the privileges of the Langflow service process. The fix validates the generated code's abstract syntax tree and evaluates it with a restricted builtins mapping.

How do I fix this?

Upgrade the langflow library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run flows that use the Smart Transform (Lambda Filter) component with author-controlled or externally influenced instructions or input data.