CVE-2026-0770: Langflow's Code Validator Executes Arbitrary Python Code
Attack Techniques & Methods2026-11-06, 13:33
A researcher has published an analysis of the vulnerability CVE-2026-0770 in Langflow, a platform for visually building AI agents. The flaw allows an unauthenticated attacker to execute arbitrary code on the server with root privileges. The vulnerability received a CVSS score of 9.8, was added to the Known Exploited Vulnerabilities (KEV) catalog, and affects Langflow versions up to and including 1.7.3..
What’s the issue?
The
validate_code() function in src/backend/base/langflow/utils/validate.py parses the supplied code into an AST, compiles function definitions, and executes the resulting code using exec(). The validator does not inspect the function bodies for dangerous construct. Instead, it only checks whether an exception is raised during execution. In other words, code validation is effectively code execution.How the exploit works
The attack does not require the malicious code to be placed in the function body. The technique exploits a Python feature: default argument expressions are evaluated at function-definition time, before the function object is created.
- Command execution. A default argument contains an expression that invokes
__import__("subprocess").run(...)to execute a system command. - Returning the result. The command’s output is passed to a lambda expression that deliberately raises an exception with a message containing the captured output.
- Extracting it from the response. The
validate_code()function catches the exception, converts it to a string, and returns it in thefunction.errorsfield of the JSON response. This is how the command output is returned to the attacker. The function body itself remains empty (pass). A static analyzer that checks only the body will not detect anything suspicious. The validator compiles and executes the bytecode that evaluates the default argument, and that evaluation is where the payload runs.