CVE-2026-0771

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-0771

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0771.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-0771

Published

2026-01-23T03:28:56.528Z

Modified

2026-07-15T01:49:16.106956820Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability

Details

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Attack vectors and exploitability will vary depending on the configuration of the product.

The specific flaw exists within the handling of Python function components. Depending upon product configuration, an attacker may be able to introduce custom Python code into a workflow. An attacker can leverage this vulnerability to execute code in the context of the application. Was ZDI-CAN-27497.

Database specific

{
    "cna_assigner": "zdi",
    "cwe_ids": [
        "CWE-94"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.4.2"
                },
                {
                    "last_affected": "1.4.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0771.json"
}

References

Affected packages

Git / github.com/langflow-ai/langflow

Affected ranges

Type

GIT

Repo

https://github.com/langflow-ai/langflow

Events

Introduced

4b580d15696334e4e9455cd12506732317d6a185

Last affected

4b580d15696334e4e9455cd12506732317d6a185

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:langflow:langflow:1.4.2:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.4.2-NA"
        },
        {
            "last_affected": "1.4.2-NA"
        }
    ]
}

Affected versions

1.*

1.4.2

1.4.2-NA

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-0771.json"