Type: Code Injection
Product: langflow
Affected versions: ≤1.9.3
Affected component: src/backend/base/langflow/api/v1/validate.py:post_validate_code
Suggested CWE: CWE-94 (Code Injection)
Reference: langflow-ai/langflow#13336
A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.
Condensed from the authorized local validation used for the original report; local filesystem paths are replaced with <local-path>.
EXPECTED SUCCESSFUL RESULT:
- The marker file /tmp/poc_marker.txt is created on the server
- The file contains the expected content "RCE confirmed"
- This confirms arbitrary Python code execution ROOT CAUSE:
- The /api/v1/validate/code endpoint accepts user-supplied Python code
- The code is passed to validate_code() function which uses compile() and exec()
- No sandboxing, input validation, or security controls are applied
- Any authenticated user can execute arbitrary Python code on the server SECURITY IMPACT:
- Remote Code Execution with backend process privileges
- Ability to read/write arbitrary files
- Access to environment variables and secrets
- Potential for lateral movement and persistence
Ro1ME