CVE-2026-7700

Name of the Vulnerable Software and Affected Versions langflow versions prior to 1.8.5

Description A remote code injection flaw exists in the LambdaFilterComponent. The issue is located within the eval() function of the file src/lfx/src/lfx/components/llm operations/lambda filter.p, where improper manipulation can allow an attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the eval() function within the LambdaFilterComponent to minimize the risk of exploitation.