CyberRota Analysis
AI-GeneratedIBM Langflow OSS versions 1.0.0 to 1.10.0 are vulnerable due to a critical remote code execution flaw in the code validation API endpoint, which allows authenticated users to execute arbitrary Python code without any input validation or privilege restrictions. This vulnerability could lead to complete system compromise, as it enables attackers to run commands with the full privileges of the Langflow server process. Organizations using affected versions should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system commands with the full privileges of the Langflow server process.
Related CVEs
Other vulnerabilities affecting the same vendor(s)