{"dataType": "CVE_RECORD", "containers": {"adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "Unknown", "content": {"data": "{\"description\":\"CRITICAL\"}"}}}], "affected": [{"vendor": "pypi", "product": "langflow", "versions": [{"status": "affected", "version": "0", "lessThan": "1.9.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/advisories/GHSA-rvqx-wpfh-mfx7"}, {"url": "https://github.com/advisories/GHSA-vwmf-pq79-vjvx"}, {"url": "https://github.com/langflow-ai/langflow"}, {"url": "https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0"}, {"url": "https://github.com/langflow-ai/langflow/issues/12345"}, {"url": "https://github.com/langflow-ai/langflow/pull/12160"}, {"url": "https://github.com/langflow-ai/langflow/releases/tag/1.8.2"}, {"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx"}, {"url": "https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896"}, {"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33017"}, {"url": "https://pypi.org/project/langflow"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-33017"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017"}, {"url": "https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours"}], "descriptions": [{"lang": "en", "value": "## Summary\n\nThe `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.\n\nThis is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.\n\n## Affected Code\n\n### Vulnerable Endpoint (No Authentication)\n\n**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\n async def build_public_tmp(\n    *,\n    flow_id: uuid.UUID,\n    data: Annotated[FlowDataRequest | None, Body(embed=True)] = None,  # ATTACKER CONTROLLED\n    request: Request,\n    # ... NO Depends(get_current_active_user) -- MISSING AUTH ...\n):\n    \"\"\"Build a public flow without requiring authentication.\"\"\"\n    client_id = request.cookies.get(\"client_id\")\n    owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)\n\n    job_id = await start_flow_build(\n        flow_id=new_flow_id,\n        data=data,  # Attacker's data passed directly to graph builder\n        current_user=owner_user,\n        ...\n    )\n```\n\nCompare with the authenticated build endpoint at line 138, which requires `current_user: CurrentActiveUser`.\n\n ### Code Execution Chain\n\nWhen attacker-supplied `data` is provided, it flows through:\n\n1. `start_flow_build(data=attacker_data)` → `generate_flow_events()` -- `build.py:81`\n2. `create_graph()` → `build_graph_from_data(payload=data.model_dump())` -- `build.py:298`\n3. `Graph.from_payload(payload)` parses attacker nodes -- `base.py:1168`\n 4. `add_nodes_and_edges()` → `initialize()` → `_build_graph()` -- `base.py:270,527`\n 5. `_instantiate_components_in_vertices()` iterates nodes -- `base.py:1323`\n6. `vertex.instantiate_component()` → `instantiate_class(vertex)` -- `loading.py:28`\n 7. `code = custom_params.pop(\"code\")` extracts attacker code -- `loading.py:43`\n 8. `eval_custom_component_code(code)` → `create_class(code, class_name)` -- `eval.py:9`\n 9. `prepare_global_scope(module)` -- `validate.py:323`\n10. `exec(compiled_code, exec_globals)` -- **ARBITRARY CODE EXECUTION** -- `validate.py:397`\n\n### Unsandboxed exec() in prepare_global_scope\n\n**File:** `src/lfx/src/lfx/custom/validate.py`, lines 340-397\n\n```python\ndef prepare_global_scope(module):\n    exec_globals = globals().copy()\n\n    # Imports are resolved first (any module can be imported)\n    for node in imports:\n        module_obj = importlib.import_module(module_name)  # line 352\n        exec_globals[variable_name] = module_obj\n\n    # Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef)\n    if definitions:\n        combined_module = ast.Module(body=definitions, type_ignores=[])\n        compiled_code = compile(combined_module, \"<string>\", \"exec\")\n        exec(compiled_code, exec_globals)  # line 397 - ARBITRARY CODE EXECUTION\n```\n\n**Critical detail:** `prepare_global_scope` executes `ast.Assign` nodes. An attacker's code like `_x = os.system(\"id\")` is an assignment and will be executed during graph building -- before the flow even \"runs.\"\n\n## Prerequisites\n\n1. Target Langflow instance has at least **one public flow** (common for demos, chatbots, shared workflows)\n 2. Attacker knows the public flow's UUID (discoverable via shared links/URLs)\n 3. No authentication required -- only a `client_id` cookie (any arbitrary string value)\n\nWhen `AUTO_LOGIN=true` (the **default**), all prerequisites can be met by an unauthenticated attacker:\n1. `GET /api/v1/auto_login` → obtain superuser token\n2. `POST /api/v1/flows/` → create a public flow\n3. Exploit via `build_public_tmp` without any auth\n\n## Proof o..."}, {"lang": "en", "value": "## Summary\n\nThe `POST /api/v1/build_public_tmp/{flow_id}/flow` endpoint allows building public flows without requiring authentication. When the optional `data` parameter is supplied, the endpoint uses **attacker-controlled flow data** (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to `exec()` with zero sandboxing, resulting in unauthenticated remote code execution.\n\nThis is distinct from CVE-2025-3248, which fixed `/api/v1/validate/code` by adding authentication. The `build_public_tmp` endpoint is **designed** to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.\n\n## Affected Code\n\n### Vulnerable Endpoint (No Authentication)\n\n**File:** `src/backend/base/langflow/api/v1/chat.py`, lines 580-657\n\n```python\n@router.post(\"/build_public_tmp/{flow_id}/flow\")\nasync def build_public_tmp(\n    *,\n    flow_id: uuid.UUID,\n    data: Annotated[FlowDataRequest | None, Body(embed=True)] = None,  # ATTACKER CONTROLLED\n    request: Request,\n    # ... NO Depends(get_current_active_user) -- MISSING AUTH ...\n):\n    \"\"\"Build a public flow without requiring authentication.\"\"\"\n    client_id = request.cookies.get(\"client_id\")\n    owner_user, new_flow_id = await verify_public_flow_and_get_user(flow_id=flow_id, client_id=client_id)\n\n    job_id = await start_flow_build(\n        flow_id=new_flow_id,\n        data=data,  # Attacker's data passed directly to graph builder\n        current_user=owner_user,\n        ...\n    )\n```\n\nCompare with the authenticated build endpoint at line 138, which requires `current_user: CurrentActiveUser`.\n\n### Code Execution Chain\n\nWhen attacker-supplied `data` is provided, it flows through:\n\n1. `start_flow_build(data=attacker_data)` → `generate_flow_events()` -- `build.py:81`\n2. `create_graph()` → `build_graph_from_data(payload=data.model_dump())` -- `build.py:298`\n3. `Graph.from_payload(payload)` parses attacker nodes -- `base.py:1168`\n4. `add_nodes_and_edges()` → `initialize()` → `_build_graph()` -- `base.py:270,527`\n5. `_instantiate_components_in_vertices()` iterates nodes -- `base.py:1323`\n6. `vertex.instantiate_component()` → `instantiate_class(vertex)` -- `loading.py:28`\n7. `code = custom_params.pop(\"code\")` extracts attacker code -- `loading.py:43`\n8. `eval_custom_component_code(code)` → `create_class(code, class_name)` -- `eval.py:9`\n9. `prepare_global_scope(module)` -- `validate.py:323`\n10. `exec(compiled_code, exec_globals)` -- **ARBITRARY CODE EXECUTION** -- `validate.py:397`\n\n### Unsandboxed exec() in prepare_global_scope\n\n**File:** `src/lfx/src/lfx/custom/validate.py`, lines 340-397\n\n```python\ndef prepare_global_scope(module):\n    exec_globals = globals().copy()\n\n    # Imports are resolved first (any module can be imported)\n    for node in imports:\n        module_obj = importlib.import_module(module_name)  # line 352\n        exec_globals[variable_name] = module_obj\n\n    # Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef)\n    if definitions:\n        combined_module = ast.Module(body=definitions, type_ignores=[])\n        compiled_code = compile(combined_module, \"<string>\", \"exec\")\n        exec(compiled_code, exec_globals)  # line 397 - ARBITRARY CODE EXECUTION\n```\n\n**Critical detail:** `prepare_global_scope` executes `ast.Assign` nodes. An attacker's code like `_x = os.system(\"id\")` is an assignment and will be executed during graph building -- before the flow even \"runs.\"\n\n## Prerequisites\n\n1. Target Langflow instance has at least **one public flow** (common for demos, chatbots, shared workflows)\n2. Attacker knows the public flow's UUID (discoverable via shared links/URLs)\n3. No authentication required -- only a `client_id` cookie (any arbitrary string value)\n\nWhen `AUTO_LOGIN=true` (the **default**), all prerequisites can be met by an unauthenticated attacker:\n1. `GET /api/v1/auto_login` → obtain superuser token\n2. `POST /api/v1/flows/` → create a public flow\n3. Exploit via `build_public_tmp` without any auth\n\n## Proof of Concept..."}, {"lang": "en", "value": "Unauthenticated Remote Code Execution in Langflow via Public Flow Build Endpoint"}], "providerMetadata": {"orgId": "28c92f92-d60d-412d-b760-e73465c3df22", "shortName": "pypi", "dateUpdated": "2026-03-17T20:05:05Z", "x_subShortName": "pypi"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*"], "vendor": "langflow", "product": "langflow", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.2", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-vwmf-pq79-vjvx", "tags": ["exploit", "mitigation", "vendor-advisory"]}, {"url": "https://medium.com/@aviral23/cve-2026-33017-how-i-found-an-unauthenticated-rce-in-langflow-by-reading-the-code-they-already-dc96cdce5896", "tags": ["exploit", "third-party-advisory"]}, {"url": "https://github.com/langflow-ai/langflow/commit/73b6612e3ef25fdae0a752d75b0fabd47328d4f0", "tags": ["patch"]}, {"url": "https://github.com/langflow-ai/langflow/releases/tag/1.8.2", "tags": ["release-notes"]}, {"url": "https://github.com/advisories/GHSA-rvqx-wpfh-mfx7", "tags": ["third-party-advisory"]}, {"url": "https://www.sysdig.com/blog/cve-2026-33017-how-attackers-compromised-langflow-ai-pipelines-in-20-hours", "tags": ["x_press/media-coverage"]}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33017", "tags": ["x_us-government-resource"]}], "descriptions": [{"lang": "en", "value": "Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution. This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The build_public_tmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code. This issue has been fixed in version 1.9.0."}, {"lang": "es", "value": "Langflow es una herramienta para construir y desplegar agentes y flujos de trabajo impulsados por IA. En versiones anteriores a la 1.9.0, el endpoint POST /api/v1/build_public_tmp/{flow_id}/flow permite construir flujos públicos sin requerir autenticación. Cuando se suministra el parámetro opcional data, el endpoint utiliza datos de flujo controlados por el atacante (que contienen código Python arbitrario en las definiciones de nodos) en lugar de los datos de flujo almacenados en la base de datos. Este código se pasa a exec() sin ningún sandboxing, lo que resulta en una ejecución remota de código no autenticada. Esto es distinto de CVE-2025-3248, que corrigió /api/v1/validate/code añadiendo autenticación. El endpoint build_public_tmp está diseñado para no requerir autenticación (para flujos públicos) pero acepta incorrectamente datos de flujo suministrados por el atacante que contienen código ejecutable arbitrario. Este problema ha sido solucionado en la versión 1.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306"}, {"lang": "en", "cweId": "CWE-94", "description": "CWE-94"}, {"lang": "en", "cweId": "CWE-95", "description": "CWE-95"}]}], "providerMetadata": {"orgId": "00000000-0000-4000-A000-000000000003", "shortName": "nvd", "dateUpdated": "2026-03-20T05:16:15Z", "x_subShortName": "nvd"}}}, "cveMetadata": {"cveId": "CVE-2026-33017", "state": "PUBLISHED", "dateUpdated": "2026-05-22T12:42:29Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T05:16:15Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.0"}