CVE-2026-101861

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101861
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101861.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101861
Aliases
  • GHSA-33p4-w7j3-33mw
Published
2026-09-28T15:49:14Z
Modified
2026-09-30T03:47:07Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Langflow Code Execution via eval() in Component Input Schema
Details

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious repr method into component input options lists. The eval() sink is triggered when a component is converted into a LangChain tool via ComponentToolkit.get_tools(), including during custom component saves through the API, by interpolating options into a Literal type string that is passed directly to eval() without safe evaluation controls.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-94",
        "CWE-95"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101861.json"
}
References

Affected packages

Git / github.com/langflow-ai/langflow

Affected ranges

Type
GIT
Repo
https://github.com/langflow-ai/langflow
Events
Introduced
2eca4d9e32367d752fd906449d567ae0433dede5
Fixed
38c5df331b73bd0fc644da5e288b7a6a0e8eef9b
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
38c5df331b73bd0fc644da5e288b7a6a0e8eef9b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.0.16"
        },
        {
            "fixed":  "1.12.0"
        },
        {
            "introduced":  "0.0.94"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.1.2
1.1.3
1.1.4
1.10.0
1.2.0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.4.0
1.4.1
1.4.2
1.5.0.post1
1.8.0.rc0
1.8.0.rc1
1.8.0.rc2
1.8.0.rc3
1.8.0.rc4
1.8.0.rc5
1.8.0.rc6
1.8.1
1.8.2
1.8.3
1.9.0
1.9.3
1.9.4
1.9.5
1.9.6
v1.*
v1.0.16
v1.0.17
v1.0.18
v1.0.19
v1.1.0
v1.1.1
v1.11.0
v1.9.1
v1.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101861.json"