CVE-2026-7687: Langflow-ai Langflow RCE Vulnerability

CVE-2026-7687 Overview

CVE-2026-7687 is a command injection vulnerability in langflow-ai langflow versions up to 1.8.4. The flaw resides in the CodeParser.parse_callable_details function within src/lfx/src/lfx/custom/code_parser/code_parser.py, part of the Full Builtins Module Handler component. An authenticated remote attacker can manipulate parser inputs to inject and execute arbitrary commands. The exploit has been publicly disclosed, and the maintainer did not respond to early disclosure outreach. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).

Critical Impact

Remote authenticated attackers can trigger command injection through the langflow code parser, leading to limited confidentiality, integrity, and availability impact on the host application.

Affected Products

• langflow-ai langflow up to and including version 1.8.4
• Component: Full Builtins Module Handler (code_parser.py)
• Function: CodeParser.parse_callable_details

Discovery Timeline

• 2026-05-03 - CVE-2026-7687 published to NVD
• 2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7687

Vulnerability Analysis

The vulnerability resides in langflow's custom code parsing logic, which processes callable details derived from user-influenced Python module input. The parse_callable_details function in code_parser.py does not adequately neutralize special elements before passing parsed values into downstream execution contexts. Because langflow exposes flow-building APIs that allow authenticated users to submit code definitions, an attacker with low-privileged access can craft parser input that escapes the intended interpretation boundary. The result is command injection within the langflow process context. The EPSS score is 1.058% (77.7 percentile), indicating elevated relative likelihood of exploitation activity compared to most CVEs.

Root Cause

The root cause is improper neutralization of special elements in code passed to CodeParser.parse_callable_details. The Full Builtins Module Handler processes callable signatures without strict allowlisting or sanitization, allowing crafted input to alter the command stream evaluated by the parser pipeline.

Attack Vector

The attack is remote and requires low privileges with no user interaction. An attacker authenticates to a langflow instance and submits crafted callable definitions through the flow component import or custom-component endpoints that invoke parse_callable_details. The malicious payload is interpreted by the parser, resulting in command injection. Public disclosure of the exploit increases opportunistic risk for internet-exposed langflow deployments.

No verified proof-of-concept code is included here. Refer to the VulDB Vulnerability #360857 and the Yuque Security Document for technical disclosure details.

Detection Methods for CVE-2026-7687

Indicators of Compromise

• Unexpected child processes spawned by the langflow Python interpreter, especially shells (/bin/sh, bash, cmd.exe).
• Anomalous outbound network connections originating from the langflow service after custom component creation events.
• Modifications or new files written under langflow working directories or /tmp shortly after parse_callable_details invocations.

Detection Strategies

• Enable verbose application logging on langflow custom-component and code-parser endpoints to capture submitted code payloads.
• Hunt for process-tree anomalies where the langflow process forks system shells or interpreters not part of normal workflow execution.
• Correlate authenticated API requests to /custom_component or flow update endpoints with subsequent process or network activity.

Monitoring Recommendations

• Monitor langflow audit logs for unusual authenticated user activity, particularly bulk creation or import of custom components.
• Alert on egress traffic from AI/ML inference hosts to untrusted destinations, which often indicate post-exploitation command-and-control.
• Track file integrity within langflow installation directories to detect tampering after parser execution.

How to Mitigate CVE-2026-7687

Immediate Actions Required

• Restrict network exposure of langflow instances; place behind authenticated reverse proxies or VPN-only access.
• Audit existing langflow user accounts and revoke unnecessary low-privilege access that could be leveraged for exploitation.
• Review recent custom component submissions for malicious payloads matching the disclosed exploit pattern.

Patch Information

At the time of NVD publication (2026-05-03), the vendor had not responded to disclosure and no fixed version is identified in the available CVE record. Track the VulDB advisory for #360857 and the upstream langflow repository for an official patch beyond version 1.8.4.

Workarounds

• Disable or gate access to custom-component creation endpoints until a patched version is available.
• Run langflow inside a hardened container or sandbox with no outbound network access and a read-only filesystem where feasible.
• Apply least-privilege service accounts so any successful command injection has minimal host impact.
• Implement a web application firewall rule to inspect and block payloads targeting the parse_callable_details parser path.

# Example: run langflow with restricted privileges and no shell
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=internal-only \
  --user 10001:10001 \
  -p 7860:7860 \
  langflowai/langflow:latest