CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution Author: dynamo2k1 Severity: Critical CVSSv3: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Overview CVE-2026-33017 is a critical unauthenticated Remote Code Execution vulnerability in Langflow, an open-source platform for visually building...

CVE-2026-0770-PoC

CVE-2026-0770 - Langflow Remote Code Execution Summary Langflow contains a critical remote code execution vulnerability in the validatecode function located in src/lfx/src/lfx/custom/validate.py. The function uses exec to execute user-supplied Python code without sandboxing, allowing arbitrary...

langflow-CVE-2026-17633-PoC

CVE-2026-17633 & CVE-2026-17632 — IBM Langflow OSS RCE For educational purposes only. Only use against systems you own or have explicit written authorization to test. 1. Introduction What is Langflow Langflow is an open-source low-code platform for building LLM-powered applications and AI agent...

PT-2026-99924

Name of the Vulnerable Software and Affected Versions Langflow versions 0.0.94 through 1.11.x Langflow versions 1.0.16 through 1.11.x Description An unsafe eval function in schema.py allows authenticated attackers to achieve remote code execution. This occurs when a Python object containing a...

Langflow AI Custom Component Authenticated Remote Code Execution

Langflow versions 1.0.0 through 1.11.1 are susceptible to authenticated remote code execution due to improper enforcement of security restrictions of code generation on the /api/v1/customcomponent endpoint. The endpoint accepts attacker controlled code that is then passed to Pythons exec function...

CVE-2026-76059

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

CVE-2026-76059 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the...

PT-2026-89610

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description A logic error in the static security scanner allows an attacker to bypass security checks by crafting an annotated class-body assignment. This technique uses alias tracking to resolve ...

CVE-2026-19295 Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...

homeassistant-stubs (2023.2.0b9), pytest-homeassistant-custom-component (0.12.51) potentially affected by CVE-2026-64825 via homeassistant (2023.2.0b9)

homeassistant PYPI version 2023.2.0b9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.2.0b9 - pytest-homeassistant-custom-component 0.12.51 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2022.12.0b3), pytest-homeassistant-custom-component (0.12.25) potentially affected by CVE-2026-64825 via homeassistant (2022.12.0b3)

homeassistant PYPI version 2022.12.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.12.0b3 - pytest-homeassistant-custom-component 0.12.25 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2022.11.2), pytest-homeassistant-custom-component (0.12.19) potentially affected by CVE-2026-64825 via homeassistant (2022.11.2)

homeassistant PYPI version 2022.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.2 - pytest-homeassistant-custom-component 0.12.19 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2022.8.0b4), pytest-homeassistant-custom-component (0.11.3) potentially affected by CVE-2026-64825 via homeassistant (2022.8.0b4)

homeassistant PYPI version 2022.8.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.8.0b4 - pytest-homeassistant-custom-component 0.11.3 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2022.11.0b2), pytest-homeassistant-custom-component (0.12.13) potentially affected by CVE-2026-64825 via homeassistant (2022.11.0b2)

homeassistant PYPI version 2022.11.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b2 - pytest-homeassistant-custom-component 0.12.13 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2022.10.4), pytest-homeassistant-custom-component (0.12.9) potentially affected by CVE-2026-64825 via homeassistant (2022.10.4)

homeassistant PYPI version 2022.10.4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.4 - pytest-homeassistant-custom-component 0.12.9 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2023.5.1), pytest-homeassistant-custom-component (0.13.29) potentially affected by CVE-2026-64825 via homeassistant (2023.5.1)

homeassistant PYPI version 2023.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.5.1 - pytest-homeassistant-custom-component 0.13.29 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2023.8.1), pytest-homeassistant-custom-component (0.13.50) potentially affected by CVE-2026-64825 via homeassistant (2023.8.1)

homeassistant PYPI version 2023.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.8.1 - pytest-homeassistant-custom-component 0.13.50 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2023.10.0b7), pytest-homeassistant-custom-component (0.13.62) potentially affected by CVE-2026-64825 via homeassistant (2023.10.0b7)

homeassistant PYPI version 2023.10.0b7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.10.0b7 - pytest-homeassistant-custom-component 0.13.62 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2023.10.0), pytest-homeassistant-custom-component (0.13.63) potentially affected by CVE-2026-64825 via homeassistant (2023.10.0)

homeassistant PYPI version 2023.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.10.0 - pytest-homeassistant-custom-component 0.13.63 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2023.4.2), pytest-homeassistant-custom-component (0.13.19) potentially affected by CVE-2026-64825 via homeassistant (2023.4.2)

homeassistant PYPI version 2023.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.4.2 - pytest-homeassistant-custom-component 0.13.19 Source cves: CVE-2026-64825 Source advisory:...