CVE-2026-7687

Name of the Vulnerable Software and Affected Versions langflow-ai langflow versions prior to 1.8.5

Description A command injection issue exists in the Full Builtins Module Handler component. The problem resides in the CodeParser.parse callable details() function within the file src/lfx/src/lfx/custom/code parser/code parser.py. This flaw allows a remote attacker to execute arbitrary commands through manipulation.

Recommendations Update to a version later than 1.8.4. As a temporary workaround, restrict access to the CodeParser.parse callable details() function to minimize the risk of exploitation.