CVE-2025-33017

Name of the Vulnerable Software and Affected Versions Langflow version 1.7.3

Description The POST /api/v1/build public tmp/{flow id}/flow endpoint allows building public flows without authentication. If the optional data parameter is provided, the system uses attacker-controlled flow data instead of the stored database data. This data can contain arbitrary Python code in node definitions, which is processed by the prepare global scope() function and executed via exec() without sandboxing. This allows an unauthenticated attacker to achieve remote code execution with full server process privileges, potentially leading to complete server compromise, environment variable exfiltration, and lateral movement within the network.

Recommendations For version 1.7.3, remove the data parameter from the build public tmp endpoint to ensure public flows only use stored data. Additionally, modify the create graph() function to ensure only the build graph from db path is reachable for unauthenticated requests.