Critical Code Injection Vulnerability in Langflow Affects Unauthenticated Users

What changed

Langflow, a tool designed for creating AI-powered agents and workflows, has a critical vulnerability that permits unauthenticated users to execute arbitrary Python code. This issue arises from the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which does not require authentication for building public flows.

When the optional data parameter is included, the endpoint processes attacker-controlled flow data instead of the intended stored flow data, leading to potential remote code execution.

Who is affected

Organizations utilizing Langflow versions prior to 1.9.0 are at risk due to this vulnerability. The following groups are particularly vulnerable:

Developers and companies leveraging Langflow for AI workflows, security teams responsible for application security, and any users who interact with public flows created through the affected endpoint.

• Langflow users operating versions before 1.9.0
• Development teams integrating Langflow into their applications
• Security professionals monitoring for vulnerabilities in AI tools

What to do

It is imperative for affected users to take immediate action to mitigate risks associated with this vulnerability. The recommended steps include:

Upgrading Langflow to version 1.9.0 or later, where this vulnerability has been addressed, and reviewing access controls for public flow creation to prevent unauthorized exploitation.

• Update Langflow to version 1.9.0 or newer
• Implement strict access controls for public flow endpoints
• Conduct a security audit of existing workflows for potential vulnerabilities