razureink/cve-2026-0770-langflow_rce_reproductionCVE Reproduction: cve-2026-0770-langflow_rce_reproduction
CVSS 9.8 (Critical) | ZDI-CAN-27325 | CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CVE-2026-0770 is a critical unauthenticated remote code execution vulnerability in Langflow, a low-code application framework for building LLM-powered apps. The flaw resides in the /api/v1/validate endpoint where the exec_globals parameter is unsafely passed to Python's exec() function, allowing unauthenticated attackers to execute arbitrary code with the privileges of the Langflow process (typically root).
Discovered through the Zero Day Initiative (ZDI-CAN-27325).
The Langflow validate endpoint at /api/v1/validate accepts a JSON payload containing a field. This dictionary is intended for internal use to pre-populate global variables during validation of custom components. However, the endpoint does not sanitize or restrict the contents of , and the values are passed directly into Python's built-in function:
exec_globalsexec_globalsexec()exec(user_code, exec_globals)
An attacker can inject arbitrary Python code by providing a crafted exec_globals dictionary that overrides built-in functions or injects malicious callables. When Langflow internally evaluates the user code with these globals, the injected code executes.
The vulnerability is classified as CWE-829 because the application includes functionality (via exec_globals) from an untrusted source (the network request) without adequate validation, leading to arbitrary code execution.
All Langflow versions prior to the patch implementing proper sanitization of exec_globals in the validate endpoint are affected. Specific affected versions include:
/api/v1/validate accepts exec_globals without validation/api/v1/validate with a malicious exec_globals payloadUse the included exploit.py script:
python exploit.py --target 192.168.1.100 --port 7860 --command "id > /tmp/pwned"
exec_globals.Disclaimer: This information is provided for educational purposes and authorized security testing only. Unauthorized use against systems you do not own or have explicit permission to test is illegal.