CVE-2026-0769

Name of the Vulnerable Software and Affected Versions Langflow (affected versions not specified)

Description Remote attackers can execute arbitrary code on affected installations without requiring authentication. The issue stems from a lack of proper validation of a user-supplied string within the eval custom component code() function before it is used to execute Python code. This allows an attacker to run code within the context of the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the eval custom component code() function to minimize the risk of exploitation.