CVE-2026-0769
published 2026-01-23CVE-2026-0769: Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on…
PriorityP195critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
41.22%
98.7th percentile
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| langflow | langflow | — | — |
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5v3c-9g74-93w7: Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
ghsa_unreviewed·2026-01-23
CVE-2026-0769 [CRITICAL] CWE-95 GHSA-5v3c-9g74-93w7: Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
VulnCheck
langflow langflow Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
vulncheck·2026·CVSS 9.8
CVE-2026-0769 [CRITICAL] langflow langflow Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
langflow langflow Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
Affected: langflow langflow
Required Action: Apply remediations or mitigations per vendor instructions or
No detection rules found.
Hackernews
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
blogs_hackernews·2026-09-01·CVSS 9.8
CVE-2026-0768 [CRITICAL] Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
Threat actors are exploiting two critical flaws impacting Langflow and Ruby on Rails, according to new findings from VulnCheck.
The vulnerabilities in question are listed below -
CVE-2026-0768 (CVSS score: 9.8) - A lack of proper validation of a user-supplied input vulnerability that could be exploited to execute arbitrary Python code in the context of the root user.
CVE-2026-66066 aka KindaRails2Shell (CVSS score: 9.5) - A vulnerability that could allow an unauthenticated attacker to read arbitrary files from the server, leak Rails p
Wiz
CVE-2026-0769 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-0769 [CRITICAL] CVE-2026-0769 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-0769 :
Homebrew vulnerability analysis and mitigation
Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of eval_custom_component_code function. The issue results from the lack of proper validation of a user-supplied string before using it to execute python code. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26972.
Source : NVD
## 9.8
Score
Published January 23, 2026
Severity CRITICAL
CNA Score 9.8
Affected Technologies
Homebrew
Has Public Exploit
2026-01-23
Published
Exploited in the wild