GHSA-9FPM-3445-2VX4
Vulnerability from github – Published: 2026-10-05 22:30 – Updated: 2026-10-05 22:30Summary
Langflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform (LambdaFilterComponent) component.
Smart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a one-line lambda from the model response, applies only syntactic format checks, evaluates it with Python's full builtins, and invokes the resulting function inside the Langflow process.
A malicious flow author can exploit this directly through the Instructions field. In deployments where an exposed flow passes attacker-controlled content into Smart Transform, an attacker may also exploit it indirectly through prompt injection, subject to the configured model following the injected instruction.
Vulnerability details
Vulnerable Code Location: src/lfx/src/lfx/components/llm_operations/lambda_filter.py (line 242 in v1.10.2)
def _validate_lambda(self, lambda_text: str) -> bool:
"""Validate the provided lambda function text."""
return lambda_text.strip().startswith("lambda") and ":" in lambda_text
# ...
return eval(lambda_text) # noqa: S307
For example, an attacker can attempt to make the model return:
lambda x: __import__("os").system("id")
This expression satisfies the vulnerable format checks. eval() creates the lambda with access to Python's default builtins, and the subsequent fn(data) invocation (in _execute_lambda) executes the command.
Successful exploitation allows code execution with the privileges of the Langflow service process. This can expose or modify credentials, files, application data, and network resources accessible to that process, and may affect other tenants in shared deployments.
PoC
https://github.com/user-attachments/assets/13c48fe1-7225-4e0d-9687-2d2df1e87f0e
Fix
The reported path was addressed by validating the generated code's AST and evaluating it with a restricted builtins mapping.
The mainline fix is in PR #13530 (1641b28f) and shipped in Langflow 1.11.0. The 1.10.3 backport is in PR #14071 (94859df3). Users should upgrade to Langflow 1.10.3 or later.
Workarounds
Until an upgrade is possible: - Remove Smart Transform from runnable flows. - Restrict flow creation, editing, and execution to trusted users. - Do not route untrusted or externally controlled data through Smart Transform. - Limit the Langflow process's filesystem, network, and credential access.
Credit
- Peyton Kennedy (p80n-sec) of Endor Labs — reporter (original finder)
- SZXSec — reporter (duplicate report)
- cyjhhh — reporter (duplicate report)
- 0gur1 — reporter (duplicate report)
- ajm4n — reporter (duplicate report, Finding 1 of a multi-finding submission)
- andifilhohub — analyst
- Jordan Frazier (jordanrfrazier) — remediation developer
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "langflow"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.10.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-7700"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T22:30:41Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nLangflow versions 1.3.0 through 1.10.2 contain a code-injection vulnerability in the Smart Transform (`LambdaFilterComponent`) component.\n\nSmart Transform places flow-author instructions and a preview of its input data into a prompt asking an LLM to generate a Python lambda. It then extracts a one-line lambda from the model response, applies only syntactic format checks, evaluates it with Python\u0027s full builtins, and invokes the resulting function inside the Langflow process.\n\nA malicious flow author can exploit this directly through the Instructions field. In deployments where an exposed flow passes attacker-controlled content into Smart Transform, an attacker may also exploit it indirectly through prompt injection, subject to the configured model following the injected instruction.\n\n## Vulnerability details\n\n**Vulnerable Code Location**: `src/lfx/src/lfx/components/llm_operations/lambda_filter.py` (line 242 in v1.10.2)\n\n```python\ndef _validate_lambda(self, lambda_text: str) -\u003e bool:\n \"\"\"Validate the provided lambda function text.\"\"\"\n return lambda_text.strip().startswith(\"lambda\") and \":\" in lambda_text\n\n# ...\nreturn eval(lambda_text) # noqa: S307\n```\n\nFor example, an attacker can attempt to make the model return:\n\n`lambda x: __import__(\"os\").system(\"id\")`\n\nThis expression satisfies the vulnerable format checks. `eval()` creates the lambda with access to Python\u0027s default builtins, and the subsequent `fn(data)` invocation (in `_execute_lambda`) executes the command.\n\nSuccessful exploitation allows code execution with the privileges of the Langflow service process. This can expose or modify credentials, files, application data, and network resources accessible to that process, and may affect other tenants in shared deployments.\n\n## PoC\n\nhttps://github.com/user-attachments/assets/13c48fe1-7225-4e0d-9687-2d2df1e87f0e\n\n## Fix\n\nThe reported path was addressed by validating the generated code\u0027s AST and evaluating it with a restricted builtins mapping.\n\nThe mainline fix is in PR #13530 (`1641b28f`) and shipped in Langflow 1.11.0. The 1.10.3 backport is in PR #14071 (`94859df3`). Users should upgrade to Langflow 1.10.3 or later.\n\n## Workarounds\n\nUntil an upgrade is possible:\n- Remove Smart Transform from runnable flows.\n- Restrict flow creation, editing, and execution to trusted users.\n- Do not route untrusted or externally controlled data through Smart Transform.\n- Limit the Langflow process\u0027s filesystem, network, and credential access.\n\n## Credit\n\n- **Peyton Kennedy ([p80n-sec](https://github.com/p80n-sec)) of Endor Labs** \u2014 reporter (original finder)\n- **[SZXSec](https://github.com/SZXSec)** \u2014 reporter (duplicate report)\n- **[cyjhhh](https://github.com/cyjhhh)** \u2014 reporter (duplicate report)\n- **[0gur1](https://github.com/0gur1)** \u2014 reporter (duplicate report)\n- **[ajm4n](https://github.com/ajm4n)** \u2014 reporter (duplicate report, Finding 1 of a multi-finding submission)\n- **[andifilhohub](https://github.com/andifilhohub)** \u2014 analyst\n- **Jordan Frazier ([jordanrfrazier](https://github.com/jordanrfrazier))** \u2014 remediation developer",
"id": "GHSA-9fpm-3445-2vx4",
"modified": "2026-10-05T22:30:41Z",
"published": "2026-10-05T22:30:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-9fpm-3445-2vx4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7700"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/pull/13530"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/commit/1641b28f33e2c47b9a0c6855922d44d1b8418b9d"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/commit/94859df33acd70b2a1f816e26d68f5e89a7e5639"
},
{
"type": "PACKAGE",
"url": "https://github.com/langflow-ai/langflow"
},
{
"type": "WEB",
"url": "https://github.com/langflow-ai/langflow/releases/tag/v1.10.3"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/804305"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/360869"
},
{
"type": "WEB",
"url": "https://www.yuque.com/mengnanbulalei/ognlsk/hte2a98ro5gf8tp9?singleDoc#%20%E3%80%8AFirst%20release%20of%20Langflow%201.8.3%20Smart%20Transform%20eval()/Lambda%20injection%20RCE%20vulnerability%20analysis+POC%E3%80%8B"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Langflow: Prompt injection in Langflow Smart Transform can lead to code execution"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.