PYSEC-2026-4237 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4239 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4241 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

GHSA-W794-RJ3P-XV45 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-105697

Langflow versions prior to 1.10.3 are vulnerable to OS command injection due to a lack of allowlisting in the MCP stdio transport configuration. An attacker capable of accessing MCP server settings or using the MCP Tools component can execute arbitrary OS commands (e.g., rm -rf, reverse shells) o...

EUVD-2026-83658

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

PT-2026-95912

Name of the Vulnerable Software and Affected Versions aiyiyi121 SxDevOps versions 1.0 through 1.1 Description A command injection flaw exists in the MCP STDIO Server Management component within the subprocess.Popen function of the backend/aiops/services.py file. A remote attacker can exploit this...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-78575

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575

IBM Langflow OSS 1.0.0–1.11.5 is vulnerable to OS command injection (CWE-78) in the MCP stdio server configuration , allowing a remote authenticated attacker to execute arbitrary commands. The root cause involves two gaps: the MCP stdio validator on Windows recognizes only one cmd.exe execution s...

CVE-2026-78575 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575 Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

CVE-2026-78575: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

PYSEC-2026-3473 LangBot: Authenticated RCE Via MCP Configuration

Summary Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command. Details The repository uses StdioServerParameters which is based on Anthropic's modelcontextprotocol open...

LangBot: Authenticated RCE Via MCP Configuration

SummaryAny authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command. DetailsThe repository uses StdioServerParameters which is based on Anthropic's modelcontextprotocol open...