CVE-2026-48519

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48519

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48519.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48519

Aliases

Published

2026-06-23T16:25:09.927Z

Modified

2026-07-08T08:12:35.543618735Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Langflow: Unauthenticated RCE in Shareable Playgrounds

Details

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/buildpublictmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48519.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ]
}

References

Affected packages

Git / github.com/langflow-ai/langflow

Affected ranges

Type

GIT

Repo

https://github.com/langflow-ai/langflow

Events

Introduced

Fixed

ea3eae8b9e011ff85d7f92f00cf07916dccf755e

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.9.2"
        }
    ]
}

Affected versions

1.*

1.1.2

1.1.3

1.1.4

1.2.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.4.0

1.4.1

1.4.2

1.5.0.post1

1.8.0.rc0

1.8.0.rc1

1.8.0.rc2

1.8.0.rc3

1.8.0.rc4

1.8.0.rc5

1.8.0.rc6

1.8.1

1.8.2

1.8.3

1.9.0

v0.*

v0.0.31

v0.0.69

v0.0.70

v0.0.71

v0.0.72

v0.0.73

v0.0.74

v0.0.75

v0.0.76

v0.0.77

v0.0.78

v0.0.79

v0.0.80

v0.0.81

v0.0.82

v0.0.83

v0.0.84

v0.0.85

v0.0.86

v0.0.87

v0.0.88

v0.0.89

v0.1.0

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.18

v0.4.19

v0.4.2

v0.4.20

v0.4.21

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.0a0

v0.5.0a1

v0.5.0a2

v0.5.0a3

v0.5.0a4

v0.5.0a5

v0.5.0a6

v0.5.0b0

v0.5.0b2

v0.5.0b3

v0.5.0b4

v0.5.0b5

v0.5.0b6

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.0a0

v0.6.0rc1

v0.6.1

v0.6.10

v0.6.11

v0.6.12

v0.6.13

v0.6.14

v0.6.15

v0.6.16

v0.6.17

v0.6.18

v0.6.19

v0.6.2

v0.6.3

v0.6.3a0

v0.6.3a1

v0.6.3a2

v0.6.3a3

v0.6.3a4

v0.6.3a5

v0.6.3a6

v0.6.4

v0.6.5

v0.6.6

v0.6.7

v0.6.8

v0.6.9

v1.*

v1.0.10

v1.0.11

v1.0.12

v1.0.13

v1.0.14

v1.0.15

v1.0.16

v1.0.17

v1.0.18

v1.0.19

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

v1.0.8

v1.0.9

v1.1.0

v1.1.1

v1.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48519.json"