William Gamazo Sanchez

An unauthenticated remote code execution flaw exists in the custom component editor's code validation logic. The issue occurs because the application fails to properly validate a user-supplied string in the `code` parameter provided to the `/api/v1/validate` endpoint before using it to execute Python code. This allows a remote attacker to execute arbitrary code in the context of root. Real-world exploitation has been observed, with over 360 attempts detected by honeypots. Attackers are using this flaw to perform system reconnaissance and harvest sensitive credentials from environment variables and the filesystem, specifically targeting `OPENAI API*`, `AWS ACCESS*`, `AWS SECRET*`, `LANGFLOW SUPERUSER`, `/root/.cache/langflow/secret key`, `.ssh` directories, and `.bash history` files.

Remote attackers can execute arbitrary code on affected installations without requiring authentication. The issue stems from the inclusion of a resource from an untrusted control sphere within the handling of the `exec globals` parameter provided to the 'validate' endpoint. This flaw allows an attacker to execute code in the context of root.

A flaw exists in Langflow related to the handling of Python function components, potentially allowing remote attackers to execute arbitrary code on affected systems. An attacker may be able to introduce custom Python code into a workflow and leverage this to execute code within the application's context. The impact and exploitability depend on the specific product configuration.