CVE-2026-13435: Langflow PythonREPL sandbox

CISO Take

IBM Langflow's PythonREPL component — the built-in tool that lets flows and agents run Python code — fails to properly validate input, allowing an attacker to break out of its sandbox and achieve full code execution on the host. This lands at CVSS 9.9, the network-exploitable, low-complexity, no-user-interaction end of the scale, and only needs low-privileged access to trigger, which describes most multi-tenant or internally-exposed Langflow deployments. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, but Langflow carries 89 other CVEs in this project alone and a package risk score of 77/100, signaling a track record of exploitable weaknesses that attackers actively mine. Treat any Langflow instance reachable from a network — especially ones exposing flows with a Python/code-execution component to low-privileged or external users — as an urgent patch target: apply IBM's fix per the linked advisory, and until patched, restrict PythonREPL-capable flows to trusted, isolated environments and monitor the Langflow host for unexpected child processes or outbound connections.

Sources: NVD ibm.com ATLAS

What is the risk?

Critical. CVSS 9.9 reflects a near-worst-case combination: network attack vector, low complexity, no user interaction, and full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), with a scope change (S:C) indicating impact beyond the vulnerable component itself. The only mitigating factor is the low-privilege requirement, which limits (but does not eliminate) exposure to authenticated or semi-trusted users — a low bar in many Langflow deployments where flows are shared across teams or exposed via internal APIs. No active exploitation (not in CISA KEV) or public PoC/Nuclei coverage is confirmed yet, but the vulnerability class (sandbox/interpreter escape, CWE-94 code injection) is exactly the kind that gets weaponized quickly once details circulate, and the package's history of 89 prior CVEs suggests attackers are already probing this codebase.

How does the attack unfold?

Initial Access

An attacker with low-privileged access to a Langflow instance (shared internal deployment or exposed API) reaches a flow containing a PythonREPL node.

AML.T0049

Sandbox Escape

Crafted input exploits the improper input validation in PythonREPL, bypassing the sandbox boundary (CWE-94).

AML.T0097

Code Execution

Arbitrary Python/OS-level code executes in the Langflow server process, giving the attacker a functional shell.

AML.T0050

Impact

The attacker exfiltrates credentials/API keys, tampers with flow logic or data, or pivots into connected LLM, vector store, or internal systems, achieving full confidentiality/integrity/availability compromise.

Initial Access

An attacker with low-privileged access to a Langflow instance (shared internal deployment or exposed API) reaches a flow containing a PythonREPL node.

AML.T0049

Sandbox Escape

Crafted input exploits the improper input validation in PythonREPL, bypassing the sandbox boundary (CWE-94).

AML.T0097

Code Execution

Arbitrary Python/OS-level code executes in the Langflow server process, giving the attacker a functional shell.

AML.T0050

Impact

The attacker exfiltrates credentials/API keys, tampers with flow logic or data, or pivots into connected LLM, vector store, or internal systems, achieving full confidentiality/integrity/availability compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 4d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

1 step

Patch: upgrade past Langflow OSS 1.10.1 per IBM's advisory (https://www.ibm.com/support/pages/node/7279987) as soon as a fixed release is confirmed available. Workaround until patched: disable or remove PythonREPL nodes from flows that don't strictly need them, restrict access to Langflow's UI/API to trusted networks or VPN, and enforce least-privilege on any accounts that can create or edit flows. Detection: monitor the Langflow host for anomalous child processes spawned from the Langflow service account, unexpected outbound network connections, and file writes outside expected working directories; review flow definitions for PythonREPL usage and audit who has permission to author or modify them. Given no Nuclei template exists yet, consider writing an internal detection rule keyed on the PythonREPL endpoint until vendor or community tooling catches up.

How is it classified?

Code Execution Framework Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0097 - Virtualization/Sandbox Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.7 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-13435?

IBM Langflow's PythonREPL component — the built-in tool that lets flows and agents run Python code — fails to properly validate input, allowing an attacker to break out of its sandbox and achieve full code execution on the host. This lands at CVSS 9.9, the network-exploitable, low-complexity, no-user-interaction end of the scale, and only needs low-privileged access to trigger, which describes most multi-tenant or internally-exposed Langflow deployments. There is no CISA KEV listing, no EPSS score, and no public exploit or Nuclei template yet, but Langflow carries 89 other CVEs in this project alone and a package risk score of 77/100, signaling a track record of exploitable weaknesses that attackers actively mine. Treat any Langflow instance reachable from a network — especially ones exposing flows with a Python/code-execution component to low-privileged or external users — as an urgent patch target: apply IBM's fix per the linked advisory, and until patched, restrict PythonREPL-capable flows to trusted, isolated environments and monitor the Langflow host for unexpected child processes or outbound connections.

Is CVE-2026-13435 actively exploited?

No confirmed active exploitation of CVE-2026-13435 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13435?

Patch: upgrade past Langflow OSS 1.10.1 per IBM's advisory (https://www.ibm.com/support/pages/node/7279987) as soon as a fixed release is confirmed available. Workaround until patched: disable or remove PythonREPL nodes from flows that don't strictly need them, restrict access to Langflow's UI/API to trusted networks or VPN, and enforce least-privilege on any accounts that can create or edit flows. Detection: monitor the Langflow host for anomalous child processes spawned from the Langflow service account, unexpected outbound network connections, and file writes outside expected working directories; review flow definitions for PythonREPL usage and audit who has permission to author or modify them. Given no Nuclei template exists yet, consider writing an internal detection rule keyed on the PythonREPL endpoint until vendor or community tooling catches up.

What systems are affected by CVE-2026-13435?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, code execution sandboxes/tools.

What is the CVSS score for CVE-2026-13435?

CVE-2026-13435 has a CVSS v3.1 base score of 9.9 (CRITICAL).

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinescode execution sandboxes/tools

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0097 Virtualization/Sandbox Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.7

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.

Exploitation Scenario

An attacker with a low-privileged Langflow account (e.g., a viewer/editor role in a shared internal instance, or access via a poorly segmented internal network) crafts malicious input to a flow's PythonREPL node. Because the sandbox fails to properly validate this input (CWE-94), the payload escapes the intended execution boundary and runs as arbitrary code in the Langflow server's process context. From there, the attacker pivots: harvesting API keys and credentials stored in Langflow's configuration, reaching connected vector databases or LLM provider accounts, or using the compromised host as a foothold to move laterally into the broader AI/ML infrastructure it orchestrates.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.