Limshow

**Name of the Vulnerable Software and Affected Versions** langflow-ai langflow versions prior to 1.8.5 **Description** A command injection issue exists in the Full Builtins Module Handler component. The problem resides in the `CodeParser.parse callable details()` function within the file src/lfx/src/lfx/custom/code parser/code parser.py. This flaw allows a remote attacker to execute arbitrary commands through manipulation. **Recommendations** Update to a version later than 1.8.4. As a temporary workaround, restrict access to the `CodeParser.parse callable details()` function to minimize the risk of exploitation.