AI Threat Alert AI Threat Alert

CVE-2026-7700

MEDIUM
Published May 3, 2026

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from...

Full CISO analysis pending enrichment.

Severity & Risk

CVSS 3.1
6.3 / 10
EPSS
N/A
Exploitation Status
No known exploitation
Sophistication
N/A

Attack Surface

AV AC PR UI S C I A
AV Network
AC Low
PR Low
UI None
S Unchanged
C Low
I Low
A Low

Recommended Action

No patch available

Monitor for updates. Consider compensating controls or temporary mitigations.

Compliance Impact

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-7700?

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Is CVE-2026-7700 actively exploited?

No confirmed active exploitation of CVE-2026-7700 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7700?

No patch is currently available. Monitor vendor advisories for updates.

What is the CVSS score for CVE-2026-7700?

CVE-2026-7700 has a CVSS v3.1 base score of 6.3 (MEDIUM).

Technical Details

NVD Description

A weakness has been identified in langflow-ai langflow up to 1.8.4. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.p of the component LambdaFilterComponent. Executing a manipulation can lead to code injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Weaknesses (CWE)

CWE-74 Primary CWE-94 Primary

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Timeline

Published
May 3, 2026
Last Modified
May 3, 2026
First Seen
May 3, 2026
Back to Threat Feed